quic-go Denial-of-Service Vulnerability via Slowloris Variant in MTU Discovery

A denial-of-service vulnerability has been identified in quic-go versions through 0.27.0. This issue allows remote attackers to cause excessive CPU consumption by sending incomplete QUIC or HTTP/3 requests, exploiting a Slowloris-like technique. The vulnerability arises from a misinterpretation of the MTU Discovery service in the file mtu_discoverer.go, leading to an overflow of the probe timer.

Impact

Exploitation of this vulnerability causes increased CPU usage, potentially leading to performance degradation or service disruption.