Quic-go vulnerabilities

Products

• Quic-go 8
• Webtransport-go 4

Newest

• quic-go webtransport-go webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules CVE-2026-57497 Fix available 5.3 MediumJuly 24, 2026
• quic-go quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion CVE-2026-40898 Fix available 5.3 MediumJune 3, 2026
• quic-go webtransport-go webtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams Map CVE-2026-21438 Fix available 5.3 MediumFebruary 12, 2026
• quic-go webtransport-go webtransport-go CloseWithError can block indefinitely CVE-2026-21435 Fix available 5.3 MediumFebruary 12, 2026
• quic-go webtransport-go webtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule CVE-2026-21434 Fix available 5.3 MediumFebruary 12, 2026
• quic-go quic-go HTTP/3 QPACK Header Expansion DoS CVE-2025-64702 Public exploitFix available 5.3 MediumDecember 11, 2025
• quic-go quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame CVE-2025-59530 Fix available 7.5 HighOctober 10, 2025
• quic-go quic-go Has Panic in Path Probe Loss Recovery Handling CVE-2025-29785 Fix available 7.5 HighJune 2, 2025
• quic-go quic-go affected by an ICMP Packet Too Large Injection Attack on Linux CVE-2024-53259 Public exploitFix available 6.5 MediumDecember 2, 2024
• quic-go QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack CVE-2024-22189 Fix available 7.5 HighApril 2, 2024
• quic-go quic-go's path validation mechanism can cause denial of service CVE-2023-49295 Fix available 6.4 MediumJanuary 10, 2024
• quic-go quic-go vulnerable to pointer dereference that can lead to panic CVE-2023-46239 Fix available 7.5 HighOctober 30, 2023