7.5

CVE-2025-59530: quic-go Reachable Assertion

CVSS: 7.5v3.1HighDeferred
AliasesRHSA-2025:21706UBUNTU-CVE-2025-59530DEBIAN-CVE-2025-59530
Published 10-10-2025Last modified 10-10-2025
Open JSON

Vulnerability summary

CVE-2025-59530 is a high (CVSS 7.5) Reachable Assertion vulnerability in quic-go. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.9% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.46%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 8
OPENSUSE-SU-2025:15710-1OPENSUSE-SU-2026:21483-1RHSA-2025:21768RHSA-2025:23069CGA-5XVR-Q2CF-3WXVCGA-8H2R-M9J3-FWCQ

Timeline

  1. 10-10-2025
    PublishedVulnerability first disclosed.
  2. 10-10-2025
    Last modifiedVulnerability information updated.

Description

quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure, leading to a process crash. This requires no authentication and can be exploited during the handshake phase. This was observed in the wild with certain server implementations. quic-go needs to be able to handle misbehaving server implementations, including those that prematurely send a HANDSHAKE_DONE frame. Versions 0.49.0, 0.54.1, and 0.55.0 discard Initial keys when receiving a HANDSHAKE_DONE frame, thereby correctly handling premature HANDSHAKE_DONE frames.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

0.46%

Chance of exploitation in the next 30 days

Percentile

39%

Versus all other CVEs

30-day change

0.00 pp

From 0.46% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.46%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard126 products
  • caddy< 2.10.2-r2
  • caddy-fips< 2.10.2-r1
  • caddy-man< 2.10.2-r2
  • caddy-src< 2.10.2-r2
  • coredns-1.12< 1.12.4-r3
Wolfi52 products
  • caddy< 2.10.2-r2
  • caddy-man< 2.10.2-r2
  • caddy-src< 2.10.2-r2
  • dkron< 4.0.8-r1
  • dkron-compat< 4.0.8-r1
Redhat4 products
  • receptor< 0:1.6.2-1.el8ap | < 0:1.6.2-1.el9ap
  • receptor-debuginfo< 0:1.6.2-1.el8ap | < 0:1.6.2-1.el9ap
  • receptor-debugsource< 0:1.6.2-1.el8ap | < 0:1.6.2-1.el9ap
  • receptorctl< 0:1.6.2-1.el8ap | < 0:1.6.2-1.el9ap
Debian1 product
  • golang-github-lucas-clemente-quic-goAll versions (No fix recorded) | < 0.54.1-1
Github.com/quic-go1 product
  • quic-go< 0.49.1 | ≥ 0.50.0, < 0.54.1
Opensuse1 product
  • teleport&distro=openSUSE Tumbleweed< 17.7.10-1.1
Quic-go1 product
  • quic-go< 0.49.1 | ≥ 0.5.0, < 0.54.1
Ubuntu1 product
  • golang-github-lucas-clemente-quic-goAll versions (No fix recorded)

8 vendors · 187 products

References

18 links
Show all 18 references