CVE catalog

CVE-2024-53259

golang-github-lucas-clemente-quic-go: CVE-2024-53259

Severity: Medium · CVSS 6.5CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Dec 2, 2024, 4:12:40 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.60% · Oct 25, 2026

quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IP_PMTUDISC_DO, the kernel would then return a "message too large" error on sendmsg, i.e. when quic-go attempts to send a packet that exceeds the MTU claimed in that ICMP packet. By setting this value to smaller than 1200 bytes (the minimum MTU for QUIC), the attacker can disrupt a QUIC connection. Crucially, this can be done after completion of the handshake, thereby circumventing any TCP fallback that might be implemented on the application layer (for example, many browsers fall back to HTTP over TCP if they're unable to establish a QUIC connection). The attacker needs to at least know the client's IP and port tuple to mount an attack. This vulnerability is fixed in 0.48.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	golang-github-lucas-clemente-quic-go	sid	`0.59.0-2`	fixed
Debian	golang-github-lucas-clemente-quic-go	forky	`0.59.0-2`	fixed
Debian	golang-github-lucas-clemente-quic-go	trixie	`0.50.1-2`	fixed
Debian	golang-github-lucas-clemente-quic-go	bookworm	`0.29.0-1`	vulnerable
Opensuse	teleport	tumbleweed	`17.0.3-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	golang-github-lucas-clemente-quic-go	source	sid	`0.50.0-1`	not yet assigned	Not reported	[1089227]
Debian	golang-github-lucas-clemente-quic-go	source	forky	`0.50.0-1`	not yet assigned	Not reported	[1089227]
Debian	golang-github-lucas-clemente-quic-go	source	trixie	`0.50.0-1`	not yet assigned	Not reported	[1089227]
Debian	golang-github-lucas-clemente-quic-go	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1089227]
Opensuse	teleport	rpm	tumbleweed	`17.0.3-1.1`	Not reported	OPENSUSE-SU-2024:14544-1	Not reported

[Debian bug #1089227]

Notes

[bookworm] golang-github-lucas-clemente-quic-go: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[golang-github-lucas-clemente-quic-go-dev]Affected
Source package: [golang-github-lucas-clemente-quic-go]
Details (4)
- 0.29.0-1 · all · bookworm
  Affected
  dsa · golang-github-lucas-clemente-quic-go · debian · bookworm; dsa · golang-github-lucas-clemente-quic-go · debian · 12
- 0.29.0-1 · all · bookworm
  Affected
  dsa · golang-github-lucas-clemente-quic-go · debian · bookworm; dsa · golang-github-lucas-clemente-quic-go · debian · 12
- 0.46.0-2~bpo12+1 · all · bookworm-backports
  Affected
  dsa · golang-github-lucas-clemente-quic-go · debian · bookworm; dsa · golang-github-lucas-clemente-quic-go · debian · 12
- 0.46.0-2~bpo12+1 · all · bookworm-backports
  Affected
  dsa · golang-github-lucas-clemente-quic-go · debian · bookworm; dsa · golang-github-lucas-clemente-quic-go · debian · 12

[openSUSE Tumbleweed]

[teleport-bash-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.0.3-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-fdpass-teleport]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 17.0.3-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tbot]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 17.0.3-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tbot-bash-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.0.3-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tbot-zsh-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.0.3-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tctl]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 17.0.3-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tctl-bash-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.0.3-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tctl-zsh-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.0.3-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tsh]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 17.0.3-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tsh-bash-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.0.3-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tsh-zsh-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.0.3-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-zsh-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.0.3-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport]Fixed
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · x86_64 · tumbleweed
  Fixed · Fixed: 17.0.3-1.1
  dsa · teleport · opensuse · tumbleweed

[Debian 13 (Trixie)]

[golang-github-lucas-clemente-quic-go-dev]Fixed
Source package: [golang-github-lucas-clemente-quic-go]
Details (4)
- 0.50.1-2 · all · trixie
  Fixed · Fixed: 0.50.0-1
  dsa · golang-github-lucas-clemente-quic-go · debian · 13
- 0.50.1-2 · all · trixie
  Fixed · Fixed: 0.50.0-1
  dsa · golang-github-lucas-clemente-quic-go · debian · 13
- 0.59.0-2~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 0.50.0-1
  dsa · golang-github-lucas-clemente-quic-go · debian · 13
- 0.59.0-2~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 0.50.0-1
  dsa · golang-github-lucas-clemente-quic-go · debian · 13

Observed: Oct 27, 2026, 12:34:14 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]