github.com/quic-go/quic-go

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

Medium 5.3

CVE-2025-64702 Public exploit

quic-go HTTP/3 QPACK Header Expansion DoS

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large head…

quic-go quic-go golang-github-lucas-clemente-quic-go github.com/quic-go/quic-go Debian Ubuntu Go

Dec 11, 2025
Medium 6.5

CVE-2024-53259 Public exploit

quic-go affected by an ICMP Packet Too Large Injection Attack on Linux

quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IP_PMTUDISC_DO, the kernel would then return a "message too large" error on sendmsg, i.e. when quic-…

quic-go quic-go github.com/quic-go/quic-go golang-github-lucas-clemente-quic-go Debian Ubuntu Go

Dec 2, 2024