---
id: CVE-2025-64702
title: quic-go is an implementation of the QUIC protocol in Go
summary: >-
  quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and
  below are vulnerable to excessive memory allocation through quic-go's HTTP/3
  client and server implementations by sending a QPACK-encoded HEADERS frame
  that dec…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-770
vendor: quic-go_project
product: quic-go
affected:
  - quic-go < 0.57.0
patched:
  - quic-go 0.57.0
published: '2025-12-11'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-64702'
references:
  - url: >-
      https://github.com/quic-go/quic-go/commit/5b2d2129f8315da41e01eff0a847ab38a34e83a8
    label: security-advisories@github.com
  - url: 'https://github.com/quic-go/quic-go/security/advisories/GHSA-g754-hx8w-x2g6'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00364
epssPercentile: 0.28547
ingestedAt: '2026-10-14T20:53:12.285Z'
---

## Overview

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.

## Affected

- `quic-go < 0.57.0`

## Remediation

Upgrade past the affected range:

- `quic-go 0.57.0`