CVE-2025-64702: medium-severity vulnerability in quic-go
quic-go HTTP/3 QPACK Header Expansion DoS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.9%
quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
quic-go · quic-goRelated CVEs — quic-go
In the same product, most dangerous first.
CVE-2023-49295MEDIUMquic-go's path validation mechanism can cause denial of serviceEPSS 1.2%CVE-2024-22189HIGHQUIC's Connection ID Mechanism vulnerable to Memory Exhaustion AttackEPSS 1.1%CVE-2023-46239HIGHquic-go vulnerable to pointer dereference that can lead to panicEPSS 1.0%CVE-2024-53259MEDIUMquic-go affected by an ICMP Packet Too Large Injection Attack on LinuxEPSS 0.6%CVE-2025-29785HIGHquic-go Has Panic in Path Probe Loss Recovery HandlingEPSS 0.5%CVE-2025-59530HIGHquic-go has Client Crash Due to Premature HANDSHAKE_DONE FrameEPSS 0.5%