PT-2025-23490 · Quic-Go+1 · Quic-Go+1

Marten-Seemann · Published 2025-06-02 · Updated 2025-07-03 · CVE-2025-29785

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions quic-go versions 0.50.0

Description The loss recovery logic for path probe packets in quic-go can be exploited by a malicious QUIC client to trigger a nil-pointer dereference. This is achieved by sending valid QUIC packets from different remote addresses, triggering the path validation logic and causing the server to send path probe packets, followed by sending specifically crafted ACKs for packets received from the server.

Recommendations For quic-go version 0.50.0, update to version 0.50.1, which contains a patch that fixes the vulnerability.

Exploit

Fix

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2025-29785

GHSA-J972-J939-P2V3

GO-2025-3735

OPENSUSE-SU-2025:15225-1

Affected Products

Debian

Quic-Go

References · 50

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29785.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-29785 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15225-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3735 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-29785 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j972-j939-p2v3 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-29785 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-29785 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-29785 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-29785 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-29785 · Security Note
• https://github.com/quic-go/quic-go · Note
• https://github.com/quic-go/quic-go/commit/b90058aba5f65f48e0e150c89bbaa21a72dda4de · Note
• https://github.com/quic-go/quic-go/issues/4981 · Note
• https://github.com/quic-go/quic-go/security/advisories/GHSA-j972-j939-p2v3 · Note