Every CVE Search/ Get API key

CVE-2025-64702

quic-go HTTP/3 QPACK Header Expansion DoS

5.3 MediumPublic exploitFix available

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.92%Up 0.9 points since Dec 12, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.3

quic-go HTTP/3 QPACK Header Expansion DoS

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.

Record
CVE-2025-64702
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-770
Updated
2026-11-02
EUVDEUVD-2025-202714 5.3

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.

Record
EUVD-2025-202714
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-g754-hx8w-x2g6 5.3

quic-go HTTP/3 QPACK Header Expansion DoS

Summary

An attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion.

Impact

A misbehaving or malicious peer can cause a denial-of-service (DoS) attack on quic-go's HTTP/3 servers or clients by triggering excessive memory allocation, potentially leading to crashes or exhaustion. It affects both servers and clients due to symmetric header construction.

Details

In HTTP/3, headers are compressed using QPACK (RFC 9204). quic-go's HTTP/3 server (and client) decodes the QPACK-encoded HEADERS frame into header fields, then constructs an http.Request (or response).

http3.Server.MaxHeaderBytes and http3.Transport.MaxResponseHeaderBytes, respectively, limit encoded HEADERS frame size (default: 1 MB server, 10 MB client), but not decoded size. A maliciously crafted HEADERS frame can expand to ~50x the encoded size using QPACK static table entries with long names / values.

RFC 9114 requires enforcing decoded field section size limits via SETTINGS, which quic-go did not do.

The Fix

quic-go now enforces RFC 9114 decoded field section size limits, sending SETTINGS_MAX_FIELD_SECTION_SIZE and using incremental QPACK decoding to check the header size after each entry, aborting early on violations with HTTP 431 (on the server side) and stream reset (on the client side).

Record
GHSA-g754-hx8w-x2g6
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-770
Updated
2026-11-02
NVD 5.3

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.

Record
CVE-2025-64702
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-770
Updated
2026-11-02
OSV 5.3

quic-go HTTP/3 QPACK Header Expansion DoS

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.

Record
CVE-2025-64702
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-770
Updated
2026-11-02
OSVDEBIAN-CVE-2025-64702 5.3

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.

Record
DEBIAN-CVE-2025-64702
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 9 moreShow less
OSVGHSA-g754-hx8w-x2g6 5.3

quic-go HTTP/3 QPACK Header Expansion DoS

Summary

An attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion.

Impact

A misbehaving or malicious peer can cause a denial-of-service (DoS) attack on quic-go's HTTP/3 servers or clients by triggering excessive memory allocation, potentially leading to crashes or exhaustion. It affects both servers and clients due to symmetric header construction.

Details

In HTTP/3, headers are compressed using QPACK (RFC 9204). quic-go's HTTP/3 server (and client) decodes the QPACK-encoded HEADERS frame into header fields, then constructs an http.Request (or response).

http3.Server.MaxHeaderBytes and http3.Transport.MaxResponseHeaderBytes, respectively, limit encoded HEADERS frame size (default: 1 MB server, 10 MB client), but not decoded size. A maliciously crafted HEADERS frame can expand to ~50x the encoded size using QPACK static table entries with long names / values.

RFC 9114 requires enforcing decoded field section size limits via SETTINGS, which quic-go did not do.

The Fix

quic-go now enforces RFC 9114 decoded field section size limits, sending SETTINGS_MAX_FIELD_SECTION_SIZE and using incremental QPACK decoding to check the header size after each entry, aborting early on violations with HTTP 431 (on the server side) and stream reset (on the client side).

Record
GHSA-g754-hx8w-x2g6
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-770
Updated
2026-11-02
OSVUBUNTU-CVE-2025-64702 5.3

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.

Record
UBUNTU-CVE-2025-64702
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVGO-2025-4233 No score

HTTP/3 QPACK Header Expansion DoS in github.com/quic-go/quic-go

HTTP/3 QPACK Header Expansion DoS in github.com/quic-go/quic-go

Record
GO-2025-4233
Updated
2026-11-02
OSVopenSUSE-SU-2026:10035-1 No score

teleport-17.7.13-1.1 on GA media

These are all security issues fixed in the teleport-17.7.13-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10035-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10131-1 No score

trivy-0.69.0-1.1 on GA media

These are all security issues fixed in the trivy-0.69.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10131-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20191-1 No score

Security update for trivy

This update for trivy fixes the following issues:

Changes in trivy:

  • Update to version 0.69.0 (bsc#1255366, CVE-2025-64702):
    • release: v0.69.0 [main] (#9886)
    • chore: bump trivy-checks to v2 (#9875)
    • chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.3.1 to 2.4.1 (#10091)
    • fix(repo): return a nil interface for gitAuth if missing (#10097)
    • fix(java): correctly inherit properties from parent fields for pom.xml files (#9111)
    • fix(rust): implement version inheritance for Cargo mono repos (#10011)
    • feat(activestate): add support ActiveState images (#10081)
    • feat(vex): support per-repo tls configuration (#10030)
    • refactor: allow per-request transport options override (#10083)
    • chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (#10084)
    • chore(deps): bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 (#10085)
    • fix(java): correctly propagate repositories from upper POMs to dependencies (#10077)
    • feat(rocky): enable modular package vulnerability detection (#10069)
    • chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.3.1 (#10079)
    • docs: fix mistake in config file example for skip-dirs/skip-files flag (#10070)
    • feat(report): add Trivy version to JSON output (#10065)
    • fix(rust): add cargo workspace members glob support (#10032)
    • feat: add AnalyzedBy field to track which analyzer detected packages (#10059)
    • fix: use canonical SPDX license IDs from embeded licenses.json (#10053)
    • docs: fix link to Docker Image Specification (#10057)
    • feat(secret): add detection for Symfony default secret key (#9892)
    • refactor(misconf): move common logic to base value and simplify typed values (#9986)
    • fix(java): add hash of GAV+root pom file path for pkgID for packages from pom.xml files (#9880)
    • feat(misconf): use Terraform plan configuration to partially restore schema (#9623)
    • feat(misconf): add action block to Terraform schema (#10035)
    • fix(misconf): correct typos in block and attribute names (#9993)
    • test(misconf): simplify test values using *Test helpers (#9985)
    • fix(misconf): safely parse rotation_period in google_kms_crypto_key (#9980)
    • feat(misconf): support for ARM resources defined as an object (#9959)
    • feat(misconf): support for azurerm_*_web_app (#9944)
    • test: migrate private test helpers to export_test.go convention (#10043)
    • chore(deps): bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.6.2 (#10048)
    • fix(secret): improve word boundary detection for Hugging Face tokens (#10046)
    • fix(go): use ldflags version for all pseudo-versions (#10037)
    • chore: switch to ID from AVDID in internal and user-facing fields (#9655)
    • refactor(misconf)!: use ID instead of AVDID for providers mapping (#9752)
    • fix: move enum into items for array-type fields in JSON Schema (#10039)
    • docs: fix incorrect documentation URLs (#10038)
    • feat(sbom): exclude PEP 770 SBOMs in .dist-info/sboms/ (#10033)
    • fix(docker): fix non-det scan results for images with embedded SBOM (#9866)
    • chore(deps): bump the github-actions group with 11 updates (#10001)
    • test: fix assertion after 2026 roll over (#10002)
    • fix(vuln): skip vulns detection for CentOS Stream family without scan failure (#9964)
    • fix(license): normalize licenses for PostAnalyzers (#9941)
    • feat(nodejs): parse licenses from package-lock.json file (#9983)
    • chore: update reference links to Go Wiki (#9987)
    • refactor: add xslices.Map and replace lo.Map usages (#9984)
    • fix(image): race condition in image artifact inspection (#9966)
    • feat(flag): add JSON Schema for trivy.yaml configuration file (#9971)
    • refactor(debian): use txtar format for test data (#9957)
    • chore(deps): bump golang.org/x/tools to v0.40.0 + gopls to v0.21.0 (#9973)
    • feat(rootio): Update trivy db to support usage of Severity from root.io feed (#9930)
    • feat(vuln): skip vulnerability scanning for third-party packages in Debian/Ubuntu…
Record
openSUSE-SU-2026:20191-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20809-1 No score

Security update for trivy

This update for trivy fixes the following issues

  • CVE-2025-64702: github.com/quic-go/quic-go/http3: quic-go HTTP/3 QPACK Header Expansion DoS (bsc#1255366).
  • CVE-2025-69725: github.com/go-chi/chi/v5: incorrect input validation in the RedirectSlashes function can lead to an open redirect (bsc#1258513).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258094).
  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260193).
  • CVE-2026-33747: github.com/moby/buildkit: malicious frontends can craft API messages that cause files to be written outside of the BuildKit state directory (bsc#1260971).
  • CVE-2026-33748: github.com/moby/buildkit: insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository (bsc#1261052).
  • CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262893).
  • CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be used to bypass some authorization controls (bsc#1262389).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264873).

Changes for trivy:

  • Updated go-git to 5.18.0.
  • Updated to version 0.70.0.
Record
openSUSE-SU-2026:20809-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21483-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
  • GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
  • GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
  • GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
  • GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
  • GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
  • GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
  • GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
  • GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
  • GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
  • GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
  • GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
  • GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
  • GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
  • GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
  • GO-2026-5933 GHSA-3g4q-2f67-2gvh
  • GO-2026-5934 GHSA-59qp-cfj3-rp64
  • GO-2026-5935 GHSA-7856-g3gv-9wq8
  • GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
  • GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
  • GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
  • GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
  • GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
  • GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
  • GO-2026-5942 CVE-2026-46600
  • GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
  • GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
  • GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
  • GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
  • GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
  • GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
  • GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
  • GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
  • GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
  • GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
  • GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
  • GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
  • GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
  • GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
  • GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
  • GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
  • GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
  • GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
  • GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
  • GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
  • GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
  • GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
  • GO-2026-5969 GHSA-g936-7jqj-mwv8
  • GO-2026-5970 CVE-2026-56852
  • GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
  • GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
  • GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
  • GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
  • GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
  • GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
  • GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
  • GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
  • GO-2026-5981 GHSA-mqxv-9rm6-w8qc
  • GO-2026-5982 GHSA-pqg7-v6wh-3pfp
  • GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
  • GO-2026-5985 GHSA-7rx3-5wx3-5v76
  • GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
  • GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
  • GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
  • GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
  • GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
  • GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
  • GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
  • GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
  • GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
  • GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
  • GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
  • GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
  • GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
  • GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
  • GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
  • GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…
Record
openSUSE-SU-2026:21483-1
Updated
2026-11-02
OSVSUSE-SU-2026:0037-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20251230T014957 2025-12-30T01:49:57Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-4249 CVE-2025-68120 CVE-2025-68120
    • GO-2025-4254 CVE-2025-62190 GHSA-gmx5-frv9-9m9f
    • GO-2025-4255 CVE-2025-12689 GHSA-j5vq-62gr-8v3r
    • GO-2025-4256 CVE-2025-13324 GHSA-x3r8-2hmh-89f5
    • GO-2025-4257 CVE-2025-68476 GHSA-c4p6-qg4m-9jmr
    • GO-2025-4258 CVE-2025-68938 GHSA-cm54-pfmc-xrwx
    • GO-2025-4261 CVE-2025-68939 GHSA-263q-5cv3-xq9g
    • GO-2025-4262 CVE-2025-68945 GHSA-7xq4-mwcp-q8fx
    • GO-2025-4263 CVE-2025-68942 GHSA-898p-hh3p-hf9r
    • GO-2025-4264 CVE-2025-68944 GHSA-f85h-c7m6-cfpm
    • GO-2025-4265 CVE-2025-68946 GHSA-hq57-c72x-4774
    • GO-2025-4266 CVE-2025-68943 GHSA-jhx5-4vr4-f327
    • GO-2025-4267 CVE-2025-68940 GHSA-rrcw-5rjv-vj26
    • GO-2025-4268 CVE-2025-68941 GHSA-xfq3-qj7j-4565

  • Update to version 0.0.20251222T181535 2025-12-22T18:15:35Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-4241 CVE-2025-11393 GHSA-cc8c-28gj-px38
    • GO-2025-4242 CVE-2025-13888 GHSA-pcqx-8qww-7f4v
    • GO-2025-4243 GHSA-wh6m-h6f4-rjf4
    • GO-2025-4244 CVE-2025-68274 GHSA-c623-f998-8hhv
    • GO-2025-4245 CVE-2025-68156 GHSA-cfpf-hrx2-8rv6
    • GO-2025-4247 CVE-2025-13352 GHSA-jf5h-xfw4-p8gp
    • GO-2025-4250 CVE-2025-14764 GHSA-3g75-q268-r9r6

  • Update to version 0.0.20251216T193914 2025-12-16T19:39:14Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-4239 CVE-2025-68113 GHSA-6gvq-jcmp-8959
    • GO-2025-4240 CVE-2025-13281 GHSA-r6j8-c6r2-37rr

  • Update to version 0.0.20251216T162327 2025-12-16T16:23:27Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3036 CVE-2024-41265 GHSA-vw7g-3cc7-7rmh
    • GO-2024-3057 CVE-2024-41260 GHSA-9v35-4xcr-w9ph
    • GO-2025-3437 GHSA-274v-mgcv-cm8j
    • GO-2025-3465 CVE-2025-0426 GHSA-jgfp-53c3-624w
    • GO-2025-3764 CVE-2024-44905 GHSA-6xp3-p59p-q4fj
    • GO-2025-3829 CVE-2025-54410 GHSA-4vq8-7jfc-9cvp
    • GO-2025-4116 CVE-2025-47913
    • GO-2025-4122 CVE-2025-11777 GHSA-mqcj-8c2g-h97q
    • GO-2025-4178 CVE-2025-13870 GHSA-58w6-w55x-6wq8

  • Update to version 0.0.20251215T203741 2025-12-15T20:37:41Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-4136 CVE-2025-64708 GHSA-ch7q-53v8-73pc
    • GO-2025-4137 CVE-2025-64521 GHSA-xr73-jq5p-ch8r
    • GO-2025-4148 CVE-2017-18874 GHSA-8qg8-c7mw-6fj7
    • GO-2025-4154 CVE-2025-62155 GHSA-9f46-w24h-69w4
    • GO-2025-4161 CVE-2025-65942 GHSA-66jq-2c23-2xh5
    • GO-2025-4162 CVE-2025-60633 GHSA-3j9f-7w24-pcqg
    • GO-2025-4167 CVE-2025-64715 GHSA-38pp-6gcp-rqvm
    • GO-2025-4168 CVE-2025-12419 GHSA-3x39-62h4-f8j6
    • GO-2025-4169 CVE-2025-12559 GHSA-4g87-9x45-cx2h
    • GO-2025-4170 CVE-2025-12421 GHSA-mp6x-97xj-9x62
    • GO-2025-4173 CVE-2025-10543 GHSA-32fw-gq77-f2f2
    • GO-2025-4188 CVE-2025-65637 GHSA-4f99-4q7p-p3gh
    • GO-2025-4191 CVE-2017-18878 GHSA-h564-6gc2-fcc6
    • GO-2025-4199 CVE-2017-18887 GHSA-35c4-5qfp-wxj6
    • GO-2025-4200 CVE-2017-18885 GHSA-g78f-6xq7-rrhq
    • GO-2025-4201 CVE-2017-18889 GHSA-jp57-4x34-5v94
    • GO-2025-4202 CVE-2017-18890 GHSA-m497-hq5x-6jcv
    • GO-2025-4203 CVE-2017-18888 GHSA-v2vm-hq26-5jv6
    • GO-2025-4204 CVE-2017-18886 GHSA-wvjg-33p9-938h
    • GO-2025-4205 CVE-2025-66491 GHSA-7vww-mvcr-x6vj
    • GO-2025-4206 CVE-2025-66490 GHSA-gm3x-23wp-hc2c
    • GO-2025-4207 CVE-2025-66508 GHSA-7cqv-qcq2-r765
    • GO-2025-4208 CVE-2025-66565 GHSA-m98w-cqp3-qcqr
    • GO-2025-4209 CVE-2025-66507 GHSA-qmg5-v42x-qqhq
    • GO-2025-4210 CVE-2025-67494 GHSA-7wfc-4796-gmg5
    • GO-2025-4211 GHSA-m6wq-66p2-c8pc
    • GO-2025-4212 GHSA-pfrf-9r5f-73f5
    • GO-2025-4213 CVE-2025-67495 GHSA-v959-qxv6-6f8p
    • GO-2025-4214 GHSA-4rmq-mc2c-r495
    • GO-2025-4215 CVE-2025-65796 GHSA-8jcj-g9f4-qx42
    • GO-2025-4216 CVE-2025-65798 GHSA-8p44-g572-557h
    • GO-2025-4217 CVE-2025-65795…
Record
SUSE-SU-2026:0037-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/quic-go/quic-go
Go
 before 0.57.0
0.57.0
golang-github-lucas-clemente-quic-go
Debian:12
 All versions, plus listed versions
0.29.0-10.29.2-10.29.2-20.29.2-30.37.0-1
Show 18 moreShow less
0.37.4-10.37.4-1~bpo12+10.38.2-10.38.2-20.46.0-10.46.0-20.46.0-2~bpo12+10.50.0-10.50.1-10.50.1-20.54.0-10.54.0-20.54.0-30.54.1-10.55.0-10.59.0-10.59.0-20.59.0-2~bpo13+1
 None known
golang-github-lucas-clemente-quic-go
Debian:13
 All versions, plus listed versions
0.50.1-20.54.0-10.54.0-20.54.0-30.54.1-1
Show 4 moreShow less
0.55.0-10.59.0-10.59.0-20.59.0-2~bpo13+1
 None known
golang-github-lucas-clemente-quic-go
Debian:14
 before 0.59.0-1, plus listed versions
0.50.1-20.54.0-10.54.0-20.54.0-30.54.1-10.55.0-1
0.59.0-1
govulncheck-vulndb
openSUSE:Leap 15.6
From an advisory covering 76 CVEs
 before 0.0.20251230T014957-150000.1.134.1
0.0.20251230T014957-150000.1.134.1
golang-github-lucas-clemente-quic-go
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.18.0-30.24.0-10.25.0-1
 None known
golang-github-lucas-clemente-quic-go
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.37.4-10.38.2-1
 None known
golang-github-lucas-clemente-quic-go
Ubuntu:25.10
 All versions, plus listed versions
0.50.0-10.50.1-2
 None known
golang-github-lucas-clemente-quic-go
Ubuntu:26.10
 All versions, plus listed versions
0.59.0-2
 None known
golang-github-lucas-clemente-quic-go
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.50.1-20.59.0-2
 None known
teleport
openSUSE:Tumbleweed
 before 17.7.13-1.1
17.7.13-1.1
trivy
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 0.69.0-1.1
0.69.0-1.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 1734 CVEs
 before 0.0.20260723T184607-160000.1.1
0.0.20260723T184607-160000.1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubHORKimhab/CVE-2025-64702-more2026-10-22

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-64702 is a medium vulnerability (CVSS 5.3) in Quic-go, published December 11, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.92%, the 60th percentile. Fixed in github.com/quic-go/quic-go 0.57.0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,555 references and the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open