CVE-2025-64702 - CVE House

Back to Database

Status published Medium CVE-2025-64702

quic-go HTTP/3 QPACK Header Expansion DoS

5.3 CVSS

Vulnerability Description

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64702

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from quic-go

View All →

quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame

quic-go Has Panic in Path Probe Loss Recovery Handling

quic-go affected by an ICMP Packet Too Large Injection Attack on Linux

QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack

quic-go's path validation mechanism can cause denial of service

Affected Vendor

quic-go

View all reports →

Affected Software

quic-go

Vulnerable Versions:

< 0.57.0

Timeline

Official Publish: December 11th, 2025

Last Modified: December 12th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1498 Network Denial of Service

T1190 Exploit Public-Facing Application

T1562 Impair Defenses

Defense Evasion

T1046 Network Service Discovery