GO-2025-4233

vendorUSosv

HTTP/3 QPACK Header Expansion DoS in github.com/quic-go/quic-go

view advisory published 2025-12-15Licence: per source

HTTP/3 QPACK Header Expansion DoS in github.com/quic-go/quic-go

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-64702US	—	0.92% (60th)	Exploit	2025-12-11
quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implemen…

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.