Denial-of-Service Vulnerability in quic-go Implementation of QUIC Protocol

CVE-2025-59530

What is CVE-2025-59530?

The quic-go implementation of the QUIC protocol is susceptible to a Denial-of-Service (DoS) attack in versions prior to 0.49.0, 0.54.1, and 0.55.0. A malicious server can exploit this vulnerability by causing an assertion failure in the quic-go client during the handshake phase, which could result in the client's process crashing. This attack can be executed without authentication and has been observed in real-world scenarios, highlighting the necessity for robust handling of unexpected server behaviors, such as premature sending of a HANDSHAKE_DONE frame. The newer versions of quic-go mitigate this risk by discarding Initial keys when faced with such invalid frames.

References