GHSA-2x7m-gf85-3745: 
C# vulnerability analysis and mitigation

A remote denial of service vulnerability (GHSA-2x7m-gf85-3745/CVE-2024-26190) was discovered in Microsoft QUIC (MsQuic). The vulnerability affects multiple versions of Microsoft.Native.Quic.MsQuic.OpenSSL and Microsoft.Native.Quic.MsQuic.Schannel packages, specifically versions < 2.1.12, >= 2.2.0 < 2.2.7, and >= 2.3.0 < 2.3.5. This high-severity vulnerability was disclosed on March 12, 2024, and received a CVSS score of 7.5 (GitHub Advisory).

The vulnerability is characterized by a memory leak condition (CWE-401) in the MsQuic server implementation. It features a network-based attack vector with low attack complexity, requiring no privileges or user interaction. The CVSS base metrics indicate an unchanged scope, with no impact on confidentiality or integrity, but high impact on availability. The vulnerability has been assigned the CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (GitHub Advisory).

The vulnerability allows an attacker to cause the MsQuic server to continuously leak memory until no more is available, resulting in a denial of service condition. This can lead to service unavailability and system resource exhaustion (GitHub Advisory).

The vulnerability can be exploited remotely over the network, requiring no special privileges or user interaction. The low attack complexity suggests that exploitation is straightforward, though no reports of active exploitation in the wild have been documented (GitHub Advisory).

The vulnerability has been patched in versions 2.1.12, 2.2.7, and 2.3.5 of the affected packages. The fix addresses the memory leak from multiple decodes of TP. Beyond upgrading to these patched versions, no other workarounds are available (GitHub Advisory).