Vulnerability Details CVE-2025-64702
quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 23.5%
CVSS Severity
CVSS v3 Score 5.3
References
Products affected by CVE-2025-64702
-
cpe:2.3:a:quic-go_project:quic-go:-
-
cpe:2.3:a:quic-go_project:quic-go:0.10.0
-
cpe:2.3:a:quic-go_project:quic-go:0.10.1
-
cpe:2.3:a:quic-go_project:quic-go:0.10.2
-
cpe:2.3:a:quic-go_project:quic-go:0.11.0
-
cpe:2.3:a:quic-go_project:quic-go:0.11.1
-
cpe:2.3:a:quic-go_project:quic-go:0.11.2
-
cpe:2.3:a:quic-go_project:quic-go:0.12.0
-
cpe:2.3:a:quic-go_project:quic-go:0.12.1
-
cpe:2.3:a:quic-go_project:quic-go:0.13.0
-
cpe:2.3:a:quic-go_project:quic-go:0.13.1
-
cpe:2.3:a:quic-go_project:quic-go:0.14.0
-
cpe:2.3:a:quic-go_project:quic-go:0.14.1
-
cpe:2.3:a:quic-go_project:quic-go:0.14.2
-
cpe:2.3:a:quic-go_project:quic-go:0.14.3
-
cpe:2.3:a:quic-go_project:quic-go:0.14.4
-
cpe:2.3:a:quic-go_project:quic-go:0.15.0
-
cpe:2.3:a:quic-go_project:quic-go:0.15.1
-
cpe:2.3:a:quic-go_project:quic-go:0.15.2
-
cpe:2.3:a:quic-go_project:quic-go:0.15.3
-
cpe:2.3:a:quic-go_project:quic-go:0.15.4
-
cpe:2.3:a:quic-go_project:quic-go:0.15.5
-
cpe:2.3:a:quic-go_project:quic-go:0.15.6
-
cpe:2.3:a:quic-go_project:quic-go:0.15.7
-
cpe:2.3:a:quic-go_project:quic-go:0.15.8
-
cpe:2.3:a:quic-go_project:quic-go:0.16.0
-
cpe:2.3:a:quic-go_project:quic-go:0.16.1
-
cpe:2.3:a:quic-go_project:quic-go:0.16.2
-
cpe:2.3:a:quic-go_project:quic-go:0.17.0
-
cpe:2.3:a:quic-go_project:quic-go:0.17.1
-
cpe:2.3:a:quic-go_project:quic-go:0.17.2
-
cpe:2.3:a:quic-go_project:quic-go:0.17.3
-
cpe:2.3:a:quic-go_project:quic-go:0.18.0
-
cpe:2.3:a:quic-go_project:quic-go:0.18.1
-
cpe:2.3:a:quic-go_project:quic-go:0.19.0
-
cpe:2.3:a:quic-go_project:quic-go:0.19.1
-
cpe:2.3:a:quic-go_project:quic-go:0.19.2
-
cpe:2.3:a:quic-go_project:quic-go:0.19.3
-
cpe:2.3:a:quic-go_project:quic-go:0.20.0
-
cpe:2.3:a:quic-go_project:quic-go:0.20.1
-
cpe:2.3:a:quic-go_project:quic-go:0.21
-
cpe:2.3:a:quic-go_project:quic-go:0.21.0
-
cpe:2.3:a:quic-go_project:quic-go:0.21.1
-
cpe:2.3:a:quic-go_project:quic-go:0.21.2
-
cpe:2.3:a:quic-go_project:quic-go:0.22.0
-
cpe:2.3:a:quic-go_project:quic-go:0.22.1
-
cpe:2.3:a:quic-go_project:quic-go:0.23.0
-
cpe:2.3:a:quic-go_project:quic-go:0.24.0
-
cpe:2.3:a:quic-go_project:quic-go:0.25.0
-
cpe:2.3:a:quic-go_project:quic-go:0.26.0
-
cpe:2.3:a:quic-go_project:quic-go:0.27.0
-
cpe:2.3:a:quic-go_project:quic-go:0.27.1
-
cpe:2.3:a:quic-go_project:quic-go:0.27.2
-
cpe:2.3:a:quic-go_project:quic-go:0.28.0
-
cpe:2.3:a:quic-go_project:quic-go:0.28.1
-
cpe:2.3:a:quic-go_project:quic-go:0.29.0
-
cpe:2.3:a:quic-go_project:quic-go:0.29.1
-
cpe:2.3:a:quic-go_project:quic-go:0.29.2
-
cpe:2.3:a:quic-go_project:quic-go:0.30.0
-
cpe:2.3:a:quic-go_project:quic-go:0.31.0
-
cpe:2.3:a:quic-go_project:quic-go:0.31.1
-
cpe:2.3:a:quic-go_project:quic-go:0.32.0
-
cpe:2.3:a:quic-go_project:quic-go:0.33.0
-
cpe:2.3:a:quic-go_project:quic-go:0.33.1
-
cpe:2.3:a:quic-go_project:quic-go:0.34.0
-
cpe:2.3:a:quic-go_project:quic-go:0.35.0
-
cpe:2.3:a:quic-go_project:quic-go:0.35.1
-
cpe:2.3:a:quic-go_project:quic-go:0.36.0
-
cpe:2.3:a:quic-go_project:quic-go:0.36.1
-
cpe:2.3:a:quic-go_project:quic-go:0.36.2
-
cpe:2.3:a:quic-go_project:quic-go:0.36.3
-
cpe:2.3:a:quic-go_project:quic-go:0.36.4
-
cpe:2.3:a:quic-go_project:quic-go:0.37.0
-
cpe:2.3:a:quic-go_project:quic-go:0.37.1
-
cpe:2.3:a:quic-go_project:quic-go:0.37.2
-
cpe:2.3:a:quic-go_project:quic-go:0.37.3
-
cpe:2.3:a:quic-go_project:quic-go:0.37.4
-
cpe:2.3:a:quic-go_project:quic-go:0.37.5
-
cpe:2.3:a:quic-go_project:quic-go:0.37.6
-
cpe:2.3:a:quic-go_project:quic-go:0.37.7
-
cpe:2.3:a:quic-go_project:quic-go:0.38.0
-
cpe:2.3:a:quic-go_project:quic-go:0.38.1
-
cpe:2.3:a:quic-go_project:quic-go:0.38.2
-
cpe:2.3:a:quic-go_project:quic-go:0.39.0
-
cpe:2.3:a:quic-go_project:quic-go:0.39.1
-
cpe:2.3:a:quic-go_project:quic-go:0.39.2
-
cpe:2.3:a:quic-go_project:quic-go:0.39.3
-
cpe:2.3:a:quic-go_project:quic-go:0.39.4
-
cpe:2.3:a:quic-go_project:quic-go:0.4
-
cpe:2.3:a:quic-go_project:quic-go:0.40.0
-
cpe:2.3:a:quic-go_project:quic-go:0.40.1
-
cpe:2.3:a:quic-go_project:quic-go:0.41.0
-
cpe:2.3:a:quic-go_project:quic-go:0.42.0
-
cpe:2.3:a:quic-go_project:quic-go:0.43.0
-
cpe:2.3:a:quic-go_project:quic-go:0.43.1
-
cpe:2.3:a:quic-go_project:quic-go:0.44.0
-
cpe:2.3:a:quic-go_project:quic-go:0.45.0
-
cpe:2.3:a:quic-go_project:quic-go:0.45.1
-
cpe:2.3:a:quic-go_project:quic-go:0.45.2
-
cpe:2.3:a:quic-go_project:quic-go:0.46.0
-
cpe:2.3:a:quic-go_project:quic-go:0.47.0
-
cpe:2.3:a:quic-go_project:quic-go:0.48.0
-
cpe:2.3:a:quic-go_project:quic-go:0.48.1
-
cpe:2.3:a:quic-go_project:quic-go:0.48.2
-
cpe:2.3:a:quic-go_project:quic-go:0.49.0
-
cpe:2.3:a:quic-go_project:quic-go:0.49.1
-
cpe:2.3:a:quic-go_project:quic-go:0.5.0
-
cpe:2.3:a:quic-go_project:quic-go:0.50.0
-
cpe:2.3:a:quic-go_project:quic-go:0.50.1
-
cpe:2.3:a:quic-go_project:quic-go:0.51.0
-
cpe:2.3:a:quic-go_project:quic-go:0.52.0
-
cpe:2.3:a:quic-go_project:quic-go:0.53.0
-
cpe:2.3:a:quic-go_project:quic-go:0.54.0
-
cpe:2.3:a:quic-go_project:quic-go:0.54.1
-
cpe:2.3:a:quic-go_project:quic-go:0.55.0
-
cpe:2.3:a:quic-go_project:quic-go:0.56.0
-
cpe:2.3:a:quic-go_project:quic-go:0.6.0
-
cpe:2.3:a:quic-go_project:quic-go:0.7.0
-
cpe:2.3:a:quic-go_project:quic-go:0.8.0
-
cpe:2.3:a:quic-go_project:quic-go:0.9.0