{"id":"CVE-2025-64702","revision":"a5f0b069e80b4aec8b77faf126f2fdc3","records":[{"revision":"a5f0b069e80b4aec8b77faf126f2fdc3","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-64702","aliases":[],"title":"quic-go HTTP/3 QPACK Header Expansion DoS","description":"quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.","state":0,"publishedAt":"2025-12-11T20:58:10.517+00:00","modifiedAt":"2025-12-12T20:45:30.439+00:00","affected":[{"ecosystem":"Vendor product","name":"quic-go","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"quic-go\",\n                    \"product\": \"quic-go\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.57.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/quic-go/quic-go/security/advisories/GHSA-g754-hx8w-x2g6","https://github.com/quic-go/quic-go/commit/5b2d2129f8315da41e01eff0a847ab38a34e83a8"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-64702","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-64702","identifiers":["CVE-2025-64702"]},"retained":false,"historicalAffected":[]}],"coverage":[]}