4 ms·
CVE-2023-39322 for example QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious
by spacebacon 3y ago
CVE-2023-39322 for example
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth.
I like Google Dart and other Google products but I see too many potential issues with QUIC. From my personal experience it has behaved suspiciously on my network.
- srj 3y agoThis is a particular implementation of the QUIC protocol (which is now fixed). Do you think there haven't been vulnerabilities against TCP? Certainly TCP is battle-hardened, but QUIC will get there too.
- spacebacon 3y agoI believe in you. More of you should split off though and create more healthy competition. A 10 to 20 year plan is needed for a new protocol.