Excessive Memory Allocation Vulnerability in quic-go's HTTP/3 Client and Server
CVE-2025-64702

5.3MEDIUM

Key Information:

Vendor

Quic-go

Status
Quic-go
Vendor
CVE Published:
11 December 2025

What is CVE-2025-64702?

The quic-go implementation of the QUIC protocol prior to version 0.57.0 is susceptible to excessive memory allocation due to its handling of QPACK-encoded HEADERS frames. Attackers can exploit this vulnerability by sending specially crafted requests that cause the header field section to grow excessively large. This inadequacy arises because the implementation restricts only the size of the QPACK-compressed HEADERS frame but fails to enforce similar limits on the decoded header fields, leading to potential memory exhaustion and system instability. Users are advised to upgrade to version 0.57.0, where this issue has been resolved.

Affected Version(s)

quic-go < 0.57.0

References

https://github.com/quic-go/quic-go/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/quic-go/quic-go/commit/5b2d2129f8315da...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-64702 : Excessive Memory Allocation Vulnerability in quic-go's HTTP/3 Client and Server