Nil-Pointer Dereference in quic-go QUIC Implementation by Lyft

CVE-2025-29785

What is CVE-2025-29785?

The quic-go library, a Go implementation of the QUIC protocol, contains a vulnerability that allows a malicious QUIC client to exploit the loss recovery logic for path probe packets. By sending valid QUIC packets from multiple remote addresses, the attacker can trigger the server’s path validation logic, resulting in the server sending path probe packets. Following this, the attacker can craft specifically designed ACKs for the packets received from the server, leading to a nil-pointer dereference. This vulnerability was addressed in version 0.50.1 of quic-go, which includes a patch and automated tests to ensure that the fix covers all potential edge cases. At present, there are no known workarounds available.

References