{"id":"CVE-2023-38171","state":"PUBLISHED","title":"Microsoft QUIC Denial of Service Vulnerability","description":"Microsoft QUIC Denial of Service Vulnerability","publishedAt":"2023-10-10T17:07:23.843Z","updatedAt":"2025-04-14T22:45:47.105Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft Microsoft Visual Studio 2022 version 17.2","Microsoft Microsoft Visual Studio 2022 version 17.4","Microsoft Microsoft Visual Studio 2022 version 17.6","Microsoft Microsoft Visual Studio 2022 version 17.7","Microsoft Windows Server 2022","Microsoft Windows 11 version 21H2","Microsoft Windows 11 version 22H2","Microsoft .NET 7.0","Microsoft PowerShell 7.3"],"affected":[{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.2","versions":[{"version":"17.2.0","status":"affected","lessThan":"17.2.21","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.4","versions":[{"version":"17.4.0","status":"affected","lessThan":"17.4.13","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.6","versions":[{"version":"17.6.0","status":"affected","lessThan":"17.6.9","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.7","versions":[{"version":"17.7.0","status":"affected","lessThan":"17.7.6","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Windows Server 2022","versions":[{"version":"10.0.20348.0","status":"affected","lessThan":"10.0.20348.2031","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows 11 version 21H2","versions":[{"version":"10.0.0","status":"affected","lessThan":"10.0.22000.2538","versionType":"custom"}],"platforms":["x64-based Systems","ARM64-based Systems"]},{"vendor":"Microsoft","product":"Windows 11 version 22H2","versions":[{"version":"10.0.22621.0","status":"affected","lessThan":"10.0.22621.2428","versionType":"custom"}],"platforms":["ARM64-based Systems","x64-based Systems"]},{"vendor":"Microsoft","product":".NET 7.0","versions":[{"version":"7.0.0","status":"affected","lessThan":"7.0.13","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"PowerShell 7.3","versions":[{"version":"7.3.0","status":"affected","lessThan":"7.3.9","versionType":"custom"}],"platforms":["Unknown"]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38171"],"weaknesses":["CWE-476"],"ingestedAt":"2026-10-29T20:06:08.715Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/38xxx/CVE-2023-38171.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-38171","state":"PUBLISHED","datePublished":"2023-10-10T17:07:23.843Z","dateUpdated":"2025-04-14T22:45:47.105Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2023-07-12T23:41:45.863Z"},"containers":{"cna":{"title":"Microsoft QUIC Denial of Service Vulnerability","descriptions":[{"lang":"en-US","value":"Microsoft QUIC Denial of Service Vulnerability"}],"affected":[{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.2","versions":[{"version":"17.2.0","status":"affected","lessThan":"17.2.21","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.4","versions":[{"version":"17.4.0","status":"affected","lessThan":"17.4.13","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.6","versions":[{"version":"17.6.0","status":"affected","lessThan":"17.6.9","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.7","versions":[{"version":"17.7.0","status":"affected","lessThan":"17.7.6","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Windows Server 2022","versions":[{"version":"10.0.20348.0","status":"affected","lessThan":"10.0.20348.2031","versionType":"custom"}],"platforms":["x64-based Systems"]},{"vendor":"Microsoft","product":"Windows 11 version 21H2","versions":[{"version":"10.0.0","status":"affected","lessThan":"10.0.22000.2538","versionType":"custom"}],"platforms":["x64-based Systems","ARM64-based Systems"]},{"vendor":"Microsoft","product":"Windows 11 version 22H2","versions":[{"version":"10.0.22621.0","status":"affected","lessThan":"10.0.22621.2428","versionType":"custom"}],"platforms":["ARM64-based Systems","x64-based Systems"]},{"vendor":"Microsoft","product":".NET 7.0","versions":[{"version":"7.0.0","status":"affected","lessThan":"7.0.13","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"PowerShell 7.3","versions":[{"version":"7.3.0","status":"affected","lessThan":"7.3.9","versionType":"custom"}],"platforms":["Unknown"]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38171","name":"Microsoft QUIC Denial of Service Vulnerability","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"HIGH","baseScore":7.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-476","description":"CWE-476: NULL Pointer Dereference","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2025-04-14T22:45:47.105Z"},"datePublic":"2023-10-10T07:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.2.0","versionEndExcluding":"17.2.21"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.4.0","versionEndExcluding":"17.4.13"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*","versionStartIncluding":"17.6.0","versionEndExcluding":"17.6.9"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio:*:*:*:*:*:*:*:*","versionStartIncluding":"17.7.0","versionEndExcluding":"17.7.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.20348.0","versionEndExcluding":"10.0.20348.2031"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_11_21H2:*:*:*:*:*:*:x64:*","versionStartIncluding":"10.0.0","versionEndExcluding":"10.0.22000.2538"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_11_22H2:*:*:*:*:*:*:arm64:*","versionStartIncluding":"10.0.22621.0","versionEndExcluding":"10.0.22621.2428"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.0.13"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:powershell:*:-:*:*:*:*:*:*","versionStartIncluding":"7.3.0","versionEndExcluding":"7.3.9"}]}]}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38171","name":"Microsoft QUIC Denial of Service Vulnerability","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T17:30:14.169Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-26T21:50:15.369465Z","id":"CVE-2023-38171","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-27T20:44:45.977Z"}}]}}}