CVE-2023-36435 | MSRC Compact Detail

Severity

Important

Impact

Denial of Service

CVSS

7.5 base · 6.5 temporal

Release

2023-10-10

Signals

Microsoft QUIC Denial of Service Exploited: No Publicly disclosed: No Exploitability: Exploitation Less Likely

CWE

CWE-400: Uncontrolled Resource Consumption

Patch Diff

Loading module diff metadata...

Resolved binary override

Use this when the MSRC module name cannot be mapped automatically or the resolved binary looks wrong.

Old version New version

Description

No description was published by MSRC.

FAQ / Articles

FAQ-Where to find more info-CVE-2023-36435

Where can I find more information? Please see the GitHub Advisory relating to this vulnerability here: https://github.com/microsoft/msquic/security/advisories/GHSA-fr44-546p-7xcp#event-111622

MSRC Fields

Module / Tag

Microsoft QUIC

Release number

2023-Oct

Latest revision

2024-12-10

CNA

Microsoft

Customer action

required

Denial of service

N/A

CVSS Vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

References

MSRC

Official detail

CVE Record

CVE.org

Revision History

v1 · 2023-10-10

Information published.

v2 · 2023-10-26

Revised the Security Updates table to include PowerShell 7.3 because this version of PowerShell 7 is affected by this vulnerability. See https://github.com/PowerShell/Announcements/issues/52 for more information.

v3 · 2024-12-10

To comprehensively address CVE-2023-36435, Microsoft has released security updates on October 24, 2023 for .NET 7.0. Microsoft recommends that customers running .NET install the updates to be fully protected from the vulnerability.

CVE-2023-36435 · Microsoft QUIC Denial of Service Vulnerability