{"id":"CVE-2025-64702","revision":"9a1821463f6b48c097753306c271056f","records":[{"revision":"9a1821463f6b48c097753306c271056f","observedAt":"2026-10-25T03:17:29.935+00:00","statement":{"source":"nvd","id":"CVE-2025-64702","aliases":[],"title":"quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decode…","description":"quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.","state":0,"publishedAt":"2025-12-11T21:15:54.707+00:00","modifiedAt":"2026-10-14T20:10:00.19+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/quic-go/quic-go/commit/5b2d2129f8315da41e01eff0a847ab38a34e83a8","https://github.com/quic-go/quic-go/security/advisories/GHSA-g754-hx8w-x2g6"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-64702","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-770"],"productCriteria":["cpe:2.3:a:quic-go_project:quic-go:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2025-12-11T21:15:54.707","lastModified":"2026-10-14T20:10:00.190"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-64702","identifiers":["CVE-2025-64702"]},"retained":false,"historicalAffected":[]}],"coverage":[]}