{"id":"EUVD-2025-33746","revision":"ca5247c45060409baf538d2f0ea57c01","records":[{"revision":"ca5247c45060409baf538d2f0ea57c01","observedAt":"2026-11-03T01:07:20.561+00:00","statement":{"source":"euvd","id":"EUVD-2025-33746","aliases":["CVE-2025-59530","GHSA-47m2-4cr7-mhcw"],"title":"quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure,…","description":"quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure, leading to a process crash. This requires no authentication and can be exploited during the handshake phase. This was observed in the wild with certain server implementations. quic-go needs to be able to handle misbehaving server implementations, including those that prematurely send a HANDSHAKE_DONE frame. Versions 0.49.0, 0.54.1, and 0.55.0 discard Initial keys when receiving a HANDSHAKE_DONE frame, thereby correctly handling premature HANDSHAKE_DONE frames.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/quic-go/quic-go/security/advisories/GHSA-47m2-4cr7-mhcw","https://github.com/quic-go/quic-go/pull/5354","https://github.com/quic-go/quic-go/blob/v0.55.0/connection.go#L2682-L2685"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-33746","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 10, 2025, 4:09:55 PM","dateUpdated":"Oct 10, 2025, 4:31:47 PM"},"relatedAdvisories":[{"id":"RHSA-2025:21706","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update","vulnerabilityIds":["CVE-2025-59530"]},{"id":"RHSA-2025:21775","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update","vulnerabilityIds":["CVE-2025-9909","CVE-2025-59530"]},{"id":"openSUSE-SU-2025:15737-1","title":"teleport-17.7.10-1.1 on GA media","vulnerabilityIds":["CVE-2025-59530"]},{"id":"openSUSE-SU-2025:15710-1","title":"govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media","vulnerabilityIds":["CVE-2016-11063","CVE-2016-11066","CVE-2016-11067","CVE-2016-11068","CVE-2016-11069","CVE-2016-11070","CVE-2016-11071","CVE-2016-11072","CVE-2016-11073","CVE-2016-11074","CVE-2016-11075","CVE-2016-11076","CVE-2016-11077","CVE-2016-11078","CVE-2016-11079","CVE-2016-11080","CVE-2016-11081","CVE-2016-11082","CVE-2016-11083","CVE-2016-11084","CVE-2017-18872","CVE-2023-32199","CVE-2024-58269","CVE-2025-10545","CVE-2025-10678","CVE-2025-10954","CVE-2025-11374","CVE-2025-11375","CVE-2025-11579","CVE-2025-11621","CVE-2025-12044","CVE-2025-26625","CVE-2025-27093","CVE-2025-41410","CVE-2025-41443","CVE-2025-54286","CVE-2025-54287","CVE-2025-54288","CVE-2025-54289","CVE-2025-54290","CVE-2025-54291","CVE-2025-54293","CVE-2025-54469","CVE-2025-54470","CVE-2025-54471","CVE-2025-54499","CVE-2025-58073","CVE-2025-58075","CVE-2025-58356","CVE-2025-59043","CVE-2025-59048","CVE-2025-59530","CVE-2025-59836","CVE-2025-59937","CVE-2025-61141","CVE-2025-61524","CVE-2025-61581","CVE-2025-61688","CVE-2025-62156","CVE-2025-62157","CVE-2025-62375","CVE-2025-62506","CVE-2025-62513","CVE-2025-62705","CVE-2025-62714","CVE-2025-62725","CVE-2025-62820","CVE-2025-64101","CVE-2025-64102","CVE-2025-64103"]},{"id":"WID-SEC-W-2025-2635","title":"Red Hat Ansible Automation Platform: Schwachstelle ermöglicht Denial of Service","vulnerabilityIds":["CVE-2025-59530"]},{"id":"RHSA-2025:23069","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","vulnerabilityIds":["CVE-2025-9907","CVE-2025-9908","CVE-2025-9909","CVE-2025-58754","CVE-2025-59530","CVE-2025-64459"]},{"id":"RHSA-2026:36873","title":"Red Hat Security Advisory: Submariner v0.20 security fixes and container updates","vulnerabilityIds":["CVE-2025-47950","CVE-2025-59530","CVE-2025-61726","CVE-2025-61729","CVE-2025-68121","CVE-2025-68151","CVE-2026-26017","CVE-2026-26018","CVE-2026-44740","CVE-2026-53488","CVE-2026-53492"]},{"id":"RHSA-2025:23131","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Container Release Update","vulnerabilityIds":["CVE-2025-9907","CVE-2025-9908","CVE-2025-9909","CVE-2025-58754","CVE-2025-59530","CVE-2025-62707","CVE-2025-62727","CVE-2025-64459"]},{"id":"msrc_CVE-2025-59530","title":"quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame","vulnerabilityIds":["CVE-2025-59530"]},{"id":"RHSA-2025:21768","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","vulnerabilityIds":["CVE-2025-9909","CVE-2025-59530"]},{"id":"RHSA-2025:22784","title":"Red Hat Security Advisory: Submariner v0.22 security fixes and container updates","vulnerabilityIds":["CVE-2025-59530"]},{"id":"RHSA-2025:21892","title":"Red Hat Security Advisory: Submariner v0.21 security fixes and container updates","vulnerabilityIds":["CVE-2025-47950","CVE-2025-59530"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-33746","identifiers":["EUVD-2025-33746","CVE-2025-59530","GHSA-47m2-4cr7-mhcw"]},"retained":false,"historicalAffected":[]}],"coverage":[]}