PT-2025-41573 · Quic-Go+1 · Quic-Go+1

Rsukhodolskyi · Published 2025-10-10 · Updated 2025-11-14 · CVE-2025-59530

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions quic-go versions prior to 0.49.0 quic-go versions prior to 0.54.1 quic-go versions prior to 0.55.0

Description quic-go is an implementation of the QUIC protocol in Go. In affected versions, a malicious or misbehaving server can cause a denial-of-service (DoS) attack on the quic-go client. This occurs by triggering an assertion failure, leading to a process crash. The issue is exploitable during the handshake phase and does not require authentication. Specifically, the vulnerability stems from improper handling of the HANDSHAKE DONE frame. A server prematurely sending a HANDSHAKE DONE frame can trigger the issue. This has been observed in real-world attacks with certain server implementations.

Recommendations Update to quic-go version 0.49.0 or later. Update to quic-go version 0.54.1 or later. Update to quic-go version 0.55.0 or later.

Exploit

Fix

DoS

Assertion Failure

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-617

CWE-755

Related Identifiers

AZL-68778

AZL-68781

CVE-2025-59530

ECHO-F513-4224-6AF9

GHSA-47M2-4CR7-MHCW

GO-2025-4017

OPENSUSE-SU-2025:15710-1

OPENSUSE-SU-2025:15737-1

RHSA-2025:21706

RHSA-2025:21768

RHSA-2025:23069

Affected Products

Debian

Quic-Go

References · 98

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59530.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59530 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-47m2-4cr7-mhcw · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-59530 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-68781 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-59530 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-59530 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-59530 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-68778 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4017 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15737-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-59530 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59530 · Vendor Advisory
• https://github.com/quic-go/quic-go · Note