PT-2025-50733 · Quic-Go+1 · Quic-Go+1

CVE-2025-64702 · Publicado 2025-12-11 · Atualizado 2026-06-05

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions quic-go versions 0.56.0 and below

Description quic-go, an implementation of the QUIC protocol in Go, is susceptible to excessive memory allocation. This occurs through the HTTP/3 client and server implementations when processing a QPACK-encoded HEADERS frame that expands into a large header field section, containing numerous unique header names and/or large values. The implementation constructs an http.Header without adequately limiting the size of the decoded header, leading to potential memory exhaustion.

Recommendations Update to version 0.57.0 or later.

Exploit

Correção

DoS

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CLEANSTART-2026-VJ54611

CVE-2025-64702

GHSA-G754-HX8W-X2G6

GO-2025-4233

OPENSUSE-SU-2026:10035-1

OPENSUSE-SU-2026:10131-1

OPENSUSE-SU-2026:20191-1

OPENSUSE-SU-2026:20809-1

SUSE-SU-2026:0037-1

Produtos afetados

Debian

Quic-Go

Referências · 163

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64702.json · Exploit
• https://github.com/quic-go/quic-go · Nota
• https://github.com/quic-go/quic-go/security/advisories/GHSA-g754-hx8w-x2g6 · Aviso do Fabricante
• https://github.com/quic-go/quic-go/commit/5b2d2129f8315da41e01eff0a847ab38a34e83a8 · Correção
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-VJ54611.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-13281 · Nota de Segurança
• https://osv.dev/vulnerability/ghsa-r6j8-c6r2-37rr · Nota
• https://suse.com/security/cve/CVE-2017-18878 · Nota
• https://suse.com/security/cve/CVE-2025-65942 · Nota
• https://suse.com/security/cve/CVE-2017-18885 · Nota
• https://suse.com/security/cve/CVE-2025-67818 · Nota
• https://osv.dev/vulnerability/ghsa-g754-hx8w-x2g6 · Nota
• https://suse.com/security/cve/CVE-2025-66626 · Nota
• https://osv.dev/vulnerability/CVE-2026-33811 · Nota
• https://osv.dev/vulnerability/ghsa-h75p-j8xm-m278 · Nota