CVE-2025-64702

MediumCVSS 5.3

Published: 11/12/2025(UTC)Updated: 14/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Summary

quic-go, a QUIC protocol implementation in Go, versions 0.56.0 and below, allows excessive memory allocation by sending a QPACK-encoded HEADERS frame that decodes into a large header field section. Limits are enforced only on the compressed frame, not the decoded header, leading to memory exhaustion.

Risk Assessment

A remote attacker can send specially crafted HTTP/3 requests, causing memory exhaustion and denial of service (DoS) in applications using quic-go.

Recommendation

Update the quic-go library to version 0.57.0 or later.

Other vulnerabilities in quic-go

CVE-2026-40898Medium
quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or large values.

Original NVD description (English source)

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS