HTTP/3 QPACK Trailer Expansion Memory Exhaustion in github.com/quic-go/quic-go
HTTP/3 QPACK Trailer Expansion Memory Exhaustion in github.com/quic-go/quic-go
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-40898US | high7.5 | — | ||
quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementa… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/advisories/GHSA-g754-hx8w-x2g6WEB
- https://github.com/quic-go/quic-go/commit/c56e8c79d1627cc1ed6005b421b4b0adadd83665FIX
- https://github.com/quic-go/quic-go/pull/5642FIX
- https://github.com/quic-go/quic-go/releases/tag/v0.59.1WEB
- https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan