NRDAX-T0195 - Path Challenge Response Memory Exhaustion

Memory amplification · P2P and gossip · no bound · active · first seen 2026-07-10

provenance: Reproduced in NullRabbit's attack-reproduction pipeline

mechanism

quic-go QUIC path-validation memory exhaustion (CVE-2023-49295): flood of QUIC v1 short-header (1-RTT) packets each carrying PATH_CHALLENGE frame(s) (type 0x1a + 8B challenge data). Each PATH_CHALLENGE obliges the receiver to enqueue a PATH_RESPONSE (type 0x1b); the attacker keeps that queue from draining by collapsing the congestion window (selective ACK) and skewing the RTT estimate, so the queue of un-sendable responses grows without bound -> memory exhaustion. The 'distributed' posture additionally sources the flood from many CHANGING (spoofed) loopback addresses - each a new path that itself triggers path validation (the connection-migration angle of the same CVE). A loopback mock cannot complete a real TLS 1.3 handshake or negotiate real congestion state, so the load-bearing wire artefacts modelled are the PATH_CHALLENGE frame type, the flood density, and the changing-source-address path fan (not real QUIC keys / cwnd). public-cve-replication - replicated wire signature, not a NullRabbit measurement. Affected quic-go v0.40.0, <= v0.39.3, <= v0.38.1, <= v0.37.6; fixed v0.40.1, v0.39.4, v0.38.2, v0.37.7; severity Moderate; reported by marten-seemann (2024-01-10). Analysis: https://seemann.io/posts/2023-12-18-exploiting-quics-path-validation/. https://github.com/quic-go/quic-go/security/advisories/GHSA-ppxx-5m9h-6vxf

live exposure

No exposure data. Slashr ↗ has no risk signal mapped to this technique yet — absence of data is not absence of exposure.

instances (1)

chain	primitive	fidelity	origin	reproducer (bundle)	source
quic	quic_go_path_challenge_flood	lab	reverse-engineered-cve	quic_go_path_challenge_flood	CVE-2023-49295 ↗

related (Memory amplification)

NRDAX-T0023 - Coalesced Packet Buffer Leak active NRDAX-T0025 - Compact Block Size Integer Overflow active NRDAX-T0038 - Count Underflow Header Serving Amplification active NRDAX-T0042 - Crypto Frame Reassembly Buffer Exhaustion active NRDAX-T0046 - Decompression Bomb Resource Exhaustion active NRDAX-T0059 - Duplicate Transport Parameter Memory Leak active NRDAX-T0061 - Duplicate Tx Mempool Index Desync active NRDAX-T0071 - Ethash Verification Memory Exhaustion active

cite

https://nrdax.com/techniques/NRDAX-T0195

plain

NRDAX Registry. Technique NRDAX-T0195.

bibtex

@misc{nrdax_NRDAX_T0195,
  title = {Path Challenge Response Memory Exhaustion (NRDAX-T0195)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0195},
}

json (csl)

{
  "id": "nrdax-NRDAX-T0195",
  "type": "dataset",
  "title": "Path Challenge Response Memory Exhaustion (NRDAX-T0195)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0195",
  "publisher": "NRDAX Registry"
}

badge

[![NRDAX-T0195 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0195.svg)](https://nrdax.com/techniques/NRDAX-T0195-path-challenge-response-memory-exhaustion)

use from the CLI

Retrieve or cite this technique from a script or the terminal with the NRDAX Python library & CLI.

Retrieve this technique

nrdax get NRDAX-T0195

Cite it (BibTeX)

nrdax cite NRDAX-T0195 --format bibtex

CLI guide → GitHub ↗