CVE-2023-38171: Microsoft QUIC Denial of Service Vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 71.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-10 · updated 2026-06-17
Weakness: CWE-476

Description

Microsoft QUIC Denial of Service Vulnerability

Affected products

Microsoft .NET: from 7.0.0 before 7.0.12 — fixed in 7.0.12
Microsoft Visual Studio 2022 version 17.14: from 17.2.0 before 17.2.20; from 17.4.0 before 17.4.12; from 17.6.0 before 17.6.8; from 17.7.0 before 17.7.5 — fixed in 17.2.20, 17.4.12, 17.6.8, 17.7.5
Microsoft Windows 11: before 10.0.22621.2428 — fixed in 10.0.22621.2428
Microsoft Windows Server 2022: all versions
Microsoft .NET 7.0: from 7.0.0 before 7.0.13 — fixed in 7.0.13
Microsoft Visual Studio 2022 version 17.2: from 17.2.0 before 17.2.21 — fixed in 17.2.21
Microsoft Visual Studio 2022 version 17.4: from 17.4.0 before 17.4.13 — fixed in 17.4.13
Microsoft Visual Studio 2022 version 17.6: from 17.6.0 before 17.6.9 — fixed in 17.6.9
Microsoft PowerShell 7.3: from 7.3.0 before 7.3.9 — fixed in 7.3.9
Microsoft Visual Studio 2022 version 17.14: from 17.7.0 before 17.7.6 — fixed in 17.7.6
Microsoft Windows 11 21H2: from 10.0.0 before 10.0.22000.2538 — fixed in 10.0.22000.2538
Microsoft Windows 11: from 10.0.22621.0 before 10.0.22621.2428 — fixed in 10.0.22621.2428
Microsoft Windows Server 2022: from 10.0.20348.0 before 10.0.20348.2031 — fixed in 10.0.20348.2031

How to fix

Upgrade to a fixed version: Microsoft .NET 7.0.12; Microsoft Visual Studio 2022 version 17.14 17.2.20, 17.4.12, 17.6.8, 17.7.5; Microsoft Windows 11 10.0.22621.2428; Microsoft .NET 7.0 7.0.13; Microsoft Visual Studio 2022 version 17.2 17.2.21; Microsoft Visual Studio 2022 version 17.4 17.4.13; Microsoft Visual Studio 2022 version 17.6 17.6.9; Microsoft PowerShell 7.3 7.3.9; Microsoft Visual Studio 2022 version 17.14 17.7.6; Microsoft Windows 11 21H2 10.0.22000.2538; Microsoft Windows 11 10.0.22621.2428; Microsoft Windows Server 2022 10.0.20348.2031. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-38171 or the next vulnerability affects your stack