CVE-2025-64702

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/quic-go/quic-go/commit/5b2d2129f8315da41e01eff0a847ab38a34e83a8	Patch
https://github.com/quic-go/quic-go/security/advisories/GHSA-g754-hx8w-x2g6	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:quic-go_project:quic-go:*:*:*:*:*:*:*:*

History

14 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) quic-go es una implementación del protocolo QUIC en Go. Las versiones 0.56.0 y anteriores son vulnerables a una asignación excesiva de memoria a través de las implementaciones de cliente y servidor HTTP/3 de quic-go al enviar un frame HEADERS codificado en QPACK que se decodifica en una sección de campo de encabezado grande (muchos nombres de encabezado únicos y/o valores grandes). La implementación construye un http.Header (utilizado en http.Request y http.Response, respectivamente), mientras que solo aplica límites al tamaño del frame HEADERS (comprimido con QPACK), pero no al encabezado decodificado, lo que lleva al agotamiento de la memoria. Este problema está solucionado en la versión 0.57.0.

Information

Published : 2025-12-11 21:15

Updated : 2026-10-14 20:10

NVD link : CVE-2025-64702

Mitre link : CVE-2025-64702

CVE.ORG link : CVE-2025-64702

JSON object : View

Products Affected

quic-go_project

quic-go

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2025-64702", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64702", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T20:44:44.521680Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "quic-go", "product": "quic-go", "versions": [{"status": "affected", "version": "< 0.57.0"}]}]}], "published": "2025-12-11T21:15:54.707", "references": [{"url": "https://github.com/quic-go/quic-go/commit/5b2d2129f8315da41e01eff0a847ab38a34e83a8", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/quic-go/quic-go/security/advisories/GHSA-g754-hx8w-x2g6", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0."}, {"lang": "es", "value": "quic-go es una implementaci\u00f3n del protocolo QUIC en Go. Las versiones 0.56.0 y anteriores son vulnerables a una asignaci\u00f3n excesiva de memoria a trav\u00e9s de las implementaciones de cliente y servidor HTTP/3 de quic-go al enviar un frame HEADERS codificado en QPACK que se decodifica en una secci\u00f3n de campo de encabezado grande (muchos nombres de encabezado \u00fanicos y/o valores grandes). La implementaci\u00f3n construye un http.Header (utilizado en http.Request y http.Response, respectivamente), mientras que solo aplica l\u00edmites al tama\u00f1o del frame HEADERS (comprimido con QPACK), pero no al encabezado decodificado, lo que lleva al agotamiento de la memoria. Este problema est\u00e1 solucionado en la versi\u00f3n 0.57.0."}], "lastModified": "2026-10-14T20:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:quic-go_project:quic-go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95E31549-EBE1-4F00-91C4-148BE3980FD0", "versionEndExcluding": "0.57.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}