{"id":"CVE-2025-64702","sourceIdentifier":"security-advisories@github.com","published":"2025-12-11T21:15:54.707","lastModified":"2026-10-14T20:10:00.190","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0."},{"lang":"es","value":"quic-go es una implementación del protocolo QUIC en Go. Las versiones 0.56.0 y anteriores son vulnerables a una asignación excesiva de memoria a través de las implementaciones de cliente y servidor HTTP/3 de quic-go al enviar un frame HEADERS codificado en QPACK que se decodifica en una sección de campo de encabezado grande (muchos nombres de encabezado únicos y/o valores grandes). La implementación construye un http.Header (utilizado en http.Request y http.Response, respectivamente), mientras que solo aplica límites al tamaño del frame HEADERS (comprimido con QPACK), pero no al encabezado decodificado, lo que lleva al agotamiento de la memoria. Este problema está solucionado en la versión 0.57.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"quic-go","product":"quic-go","versions":[{"version":"< 0.57.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-12T20:44:44.521680Z","id":"CVE-2025-64702","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:quic-go_project:quic-go:*:*:*:*:*:*:*:*","versionEndExcluding":"0.57.0","matchCriteriaId":"95E31549-EBE1-4F00-91C4-148BE3980FD0"}]}]}],"references":[{"url":"https://github.com/quic-go/quic-go/commit/5b2d2129f8315da41e01eff0a847ab38a34e83a8","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/quic-go/quic-go/security/advisories/GHSA-g754-hx8w-x2g6","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}