Excessive Memory Allocation Vulnerability in quic-go's HTTP/3 Client and Server

CVE-2025-64702

What is CVE-2025-64702?

The quic-go implementation of the QUIC protocol prior to version 0.57.0 is susceptible to excessive memory allocation due to its handling of QPACK-encoded HEADERS frames. Attackers can exploit this vulnerability by sending specially crafted requests that cause the header field section to grow excessively large. This inadequacy arises because the implementation restricts only the size of the QPACK-compressed HEADERS frame but fails to enforce similar limits on the decoded header fields, leading to potential memory exhaustion and system instability. Users are advised to upgrade to version 0.57.0, where this issue has been resolved.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References