CVE-2025-64702

Name of the Vulnerable Software and Affected Versions quic-go versions 0.56.0 and below

Description quic-go, an implementation of the QUIC protocol in Go, is susceptible to excessive memory allocation. This occurs through the HTTP/3 client and server implementations when processing a QPACK-encoded HEADERS frame that expands into a large header field section, containing numerous unique header names and/or large values. The implementation constructs an http.Header without adequately limiting the size of the decoded header, leading to potential memory exhaustion.

Recommendations Update to version 0.57.0 or later.