CVE-2024-22590

Published: May 28, 2024Modified: Jun 17, 2026Deferred

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Exploitability: 3.9 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The TLS engine in Kwik commit 745fd4e2 does not track the current state of the connection. This vulnerability can allow Client Hello messages to be overwritten at any time, including after a connection has been established.

Related CWEs

CWE-372

Incomplete Internal State Distinction

The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.

References (2)

https://gist.github.com/QUICTester/ea3eb2ac736bb63e47c654e14e3ec556

Source: cve@mitre.org

https://gist.github.com/QUICTester/ea3eb2ac736bb63e47c654e14e3ec556

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.