{"id":"EUVD-2025-202714","revision":"7758124d50334d8ba994bc136fb42dfc","records":[{"revision":"7758124d50334d8ba994bc136fb42dfc","observedAt":"2026-11-09T04:07:25.515+00:00","statement":{"source":"euvd","id":"EUVD-2025-202714","aliases":["CVE-2025-64702","GHSA-g754-hx8w-x2g6"],"title":"quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decode…","description":"quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":null}],"references":["https://github.com/quic-go/quic-go/security/advisories/GHSA-g754-hx8w-x2g6","https://github.com/quic-go/quic-go/commit/5b2d2129f8315da41e01eff0a847ab38a34e83a8"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-202714","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 11, 2025, 8:58:10 PM","dateUpdated":"Dec 12, 2025, 8:45:30 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2026:10035-1","title":"teleport-17.7.13-1.1 on GA media","vulnerabilityIds":["CVE-2025-64702"]},{"id":"openSUSE-SU-2026:20191-1","title":"Security update for trivy","vulnerabilityIds":["CVE-2025-64702","CVE-2025-66564"]},{"id":"openSUSE-SU-2026:10131-1","title":"trivy-0.69.0-1.1 on GA media","vulnerabilityIds":["CVE-2025-64702","CVE-2025-66564"]},{"id":"openSUSE-SU-2026:20809-1","title":"Security update for trivy","vulnerabilityIds":["CVE-2025-64702","CVE-2025-69725","CVE-2026-25934","CVE-2026-33186","CVE-2026-33747","CVE-2026-33748","CVE-2026-34986","CVE-2026-39984","CVE-2026-41506"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-202714","identifiers":["EUVD-2025-202714","CVE-2025-64702","GHSA-g754-hx8w-x2g6"]},"retained":false,"historicalAffected":[]}],"coverage":[]}