GHSA-47m2-4cr7-mhcwPublished

quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame

cve-program · CVE-2025-59530

Published

quic-go

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "quic-go",
                    "product": "quic-go",
                    "versions": [
                        {
                            "version": "< 0.49.1",
                            "status": "affected"
                        },
                        {
                            "version": ">= 0.5.0, < 0.54.1",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2025-33746

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Oct 10, 2025, 4:09:55 PM

dateUpdated: Oct 10, 2025, 4:31:47 PM

12 related source bulletins · separate from aliases

RHSA-2025:21706: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

CVE-2025-59530

RHSA-2025:21775: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update

CVE-2025-9909 · CVE-2025-59530

openSUSE-SU-2025:15737-1: teleport-17.7.10-1.1 on GA media

CVE-2025-59530

openSUSE-SU-2025:15710-1: govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media

CVE-2016-11063 · CVE-2016-11066 · CVE-2016-11067 · CVE-2016-11068 · CVE-2016-11069 · CVE-2016-11070 · CVE-2016-11071 · CVE-2016-11072 · CVE-2016-11073 · CVE-2016-11074 · CVE-2016-11075 · CVE-2016-11076 · CVE-2016-11077 · CVE-2016-11078 · CVE-2016-11079 · CVE-2016-11080 · CVE-2016-11081 · CVE-2016-11082 · CVE-2016-11083 · CVE-2016-11084 · CVE-2017-18872 · CVE-2023-32199 · CVE-2024-58269 · CVE-2025-10545 · CVE-2025-10678 · CVE-2025-10954 · CVE-2025-11374 · CVE-2025-11375 · CVE-2025-11579 · CVE-2025-11621 · CVE-2025-12044 · CVE-2025-26625 · CVE-2025-27093 · CVE-2025-41410 · CVE-2025-41443 · CVE-2025-54286 · CVE-2025-54287 · CVE-2025-54288 · CVE-2025-54289 · CVE-2025-54290 · CVE-2025-54291 · CVE-2025-54293 · CVE-2025-54469 · CVE-2025-54470 · CVE-2025-54471 · CVE-2025-54499 · CVE-2025-58073 · CVE-2025-58075 · CVE-2025-58356 · CVE-2025-59043 · CVE-2025-59048 · CVE-2025-59530 · CVE-2025-59836 · CVE-2025-59937 · CVE-2025-61141 · CVE-2025-61524 · CVE-2025-61581 · CVE-2025-61688 · CVE-2025-62156 · CVE-2025-62157 · CVE-2025-62375 · CVE-2025-62506 · CVE-2025-62513 · CVE-2025-62705 · CVE-2025-62714 · CVE-2025-62725 · CVE-2025-62820 · CVE-2025-64101 · CVE-2025-64102 · CVE-2025-64103

WID-SEC-W-2025-2635: Red Hat Ansible Automation Platform: Schwachstelle ermöglicht Denial of Service

CVE-2025-59530

RHSA-2025:23069: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

CVE-2025-9907 · CVE-2025-9908 · CVE-2025-9909 · CVE-2025-58754 · CVE-2025-59530 · CVE-2025-64459

RHSA-2026:36873: Red Hat Security Advisory: Submariner v0.20 security fixes and container updates

CVE-2025-47950 · CVE-2025-59530 · CVE-2025-61726 · CVE-2025-61729 · CVE-2025-68121 · CVE-2025-68151 · CVE-2026-26017 · CVE-2026-26018 · CVE-2026-44740 · CVE-2026-53488 · CVE-2026-53492

RHSA-2025:23131: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Container Release Update

CVE-2025-9907 · CVE-2025-9908 · CVE-2025-9909 · CVE-2025-58754 · CVE-2025-59530 · CVE-2025-62707 · CVE-2025-62727 · CVE-2025-64459

msrc_CVE-2025-59530: quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame

CVE-2025-59530

RHSA-2025:21768: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

CVE-2025-9909 · CVE-2025-59530

RHSA-2025:22784: Red Hat Security Advisory: Submariner v0.22 security fixes and container updates

CVE-2025-59530

RHSA-2025:21892: Red Hat Security Advisory: Submariner v0.21 security fixes and container updates

CVE-2025-47950 · CVE-2025-59530

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2025-59530

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-617 · CWE-755

Original publisher date fields

published: 2025-10-10T16:15:52.387

lastModified: 2026-10-19T16:10:00.260

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-47m2-4cr7-mhcw

Published

github.com/quic-go/quic-go

SEMVER · introduced 0 → fixed 0.49.1

github.com/quic-go/quic-go

SEMVER · introduced 0.50.0 → fixed 0.54.1

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GO-2025-4017

Published

github.com/quic-go/quic-go

SEMVER · introduced 0 → fixed 0.49.1 → introduced 0.50.0 → fixed 0.54.1

Original source record · Cite this exact observation · Complete original publisher JSON