Skip to content
OpenAdvisories
Medium · 5.3 Public exploit CVE-2025-64702 EUVD-2025-202714GHSA-g754-hx8w-x2g6GO-2025-4233

quic-go HTTP/3 QPACK Header Expansion DoS

Published Dec 11, 2025 · Updated Dec 12, 2025 · Assigned by GitHub_M

Vendor: quic-go Product: quic-go Package: buf Package: caddy Package: caddy-man Package: caddy-src Package: dkron Package: dkron-compat Package: dkron-executor-gcppubsub Package: dkron-executor-gcppubsub-compat Package: dkron-executor-grpc Package: dkron-executor-grpc-compat Package: dkron-executor-kafka Package: dkron-executor-kafka-compat Package: dkron-executor-nats-compat Package: dkron-executor-rabbitmq Package: dkron-executor-rabbitmq-compat Package: dkron-processor-files Package: dkron-processor-fluent Package: dkron-processor-log Package: dkron-processor-log-compat Package: dkron-processor-syslog Package: frp Package: github.com/quic-go/quic-go Package: golang-github-lucas-clemente-quic-go Package: golang-github-lucas-clemente-quic-go Package: ipfs-cluster Package: jitsucom-bulker-bulker Package: jitsucom-bulker-ingest Package: jitsucom-bulker-ingmgr Package: jitsucom-bulker-syncctl Package: k3s Package: k3s-1.32 Package: k3s-multicall Package: k3s-multicall-1.32 Package: k3s-static Package: k3s-static-1.32 Package: k8s_gateway Package: k8s_gateway-compat Package: kargo Package: kubernetes-dns-node-cache Package: kubo Package: q Package: seaweedfs Package: seaweedfs-iamguarded-compat Package: seaweedfs-oci-entrypoint Package: spegel Package: spegel-compat Package: traefik-3.4 Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.

Affected products

VendorProductAffectedFixed
quic-go quic-go < 0.57.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-github-lucas-clemente-quic-go 0.59.0-1 —
Debian 13 golang-github-lucas-clemente-quic-go No fix yet —
Debian 12 golang-github-lucas-clemente-quic-go No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-github-lucas-clemente-quic-go No fix yet —
Ubuntu 26.04 LTS golang-github-lucas-clemente-quic-go No fix yet —
Ubuntu 25.10 golang-github-lucas-clemente-quic-go No fix yet —
Ubuntu 24.04 LTS golang-github-lucas-clemente-quic-go No fix yet —
Ubuntu 22.04 LTS golang-github-lucas-clemente-quic-go No fix yet —

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed teleport 17.7.13-1.1 openSUSE-SU-2026:10035-1
openSUSE Tumbleweed trivy 0.69.0-1.1 openSUSE-SU-2026:10131-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20251230T014957-150000.1.134.1 SUSE-SU-2026:0037-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling buf 1.61.0-r2 —
Wolfi rolling caddy +2 2.10.2-r7 —
Wolfi rolling dkron +15 4.0.8-r4 —
Wolfi rolling frp 0.65.0-r5 —
Wolfi rolling ipfs-cluster 1.1.5-r5 —
Wolfi rolling jitsucom-bulker-bulker +3 2.11.913-r36 —
Wolfi rolling k3s +1 1.35.0.3-r0 —
Wolfi rolling k3s-1.32 +1 1.32.11.3-r0 —
Wolfi rolling k3s-multicall 1.34.2.1-r1 —
Wolfi rolling k3s-multicall-1.32 1.32.10.1-r1 —
Wolfi rolling k8s_gateway +1 1.6.1-r3 —
Wolfi rolling kargo 1.9.5-r2 —
Wolfi rolling kubernetes-dns-node-cache 1.26.7-r3 —
Wolfi rolling kubo 0.39.0-r5 —
Wolfi rolling q 0.19.11-r3 —
Wolfi rolling seaweedfs +2 4.02-r1 —
Wolfi rolling spegel +1 0.6.0-r0 —
Wolfi rolling traefik-3.4 3.4.5-r7 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/quic-go/quic-go < 0.57.0 0.57.0 GHSA-g754-hx8w-x2g6

Advisories 4

References