Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
cleanstart/go may crash when handling QUIC messages
published 5 days ago
Summary
The Go language library used by cleanstart/go can stop working if it receives an incomplete QUIC network message after the handshake. This could cause the application to halt unexpectedly, affecting availability. Update to the latest version of the cleanstart/go package, which includes a fix for this condition.
What to do
- Update cleanstart go to version 1.21.1-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | go |
< 1.21.1-r0 Fix: upgrade to 1.21.1-r0
|
Original advisory text
Processing an incomplete post-handshake message for a QUIC connection can cause a panic
Security vulnerability affects the go package. Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2024-ZN34966 · OSV
Track software like this
Free during beta