What’s Vulnerable › Vulnerabilities

CVE-2024-22588

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-24 · updated 2026-06-17
• Weakness: CWE-400

Description

Kwik commit 745fd4e2 does not discard unused encryption keys.

Affected products

• ptrd Kwik: before 0.8.13 — fixed in 0.8.13

How to fix

Upgrade to a fixed version: ptrd Kwik 0.8.13. Check the vendor advisory for mitigations.

References

• https://gist.github.com/QUICTester/29a1851c2b2a406411f688735526fe2e
• https://github.com/ptrd/kwik/issues/31
• https://www.rfc-editor.org/rfc/rfc9001#name-discarding-unused-keys
• https://gist.github.com/QUICTester/29a1851c2b2a406411f688735526fe2e
• https://github.com/ptrd/kwik/issues/31
• https://www.rfc-editor.org/rfc/rfc9001#name-discarding-unused-keys

Get alerted when CVE-2024-22588 or the next vulnerability affects your stack