CVE-2025-64702: quic-go_project quic-go

Vulnerability summary

CVE-2025-64702 is a medium (CVSS 5.3) vulnerability in quic-go_project quic-go. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.7% of scored vulnerabilities.

Timeline

1. 11-12-2025
   PublishedVulnerability first disclosed.
2. 12-12-2025
   Last modifiedVulnerability information updated.

Description

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.