quic-go has 5 CVEs on record between 2023 and 2026. 1 was published in the last 90 days. The median CVSS is 5.3 (medium). None have a confirmed exploitation report. Most affected products: github.com/quic-go/quic-go (3), github.com/quic-go/webtransport-go (1), webtransport-go (1).

CVEs per month

Last 12 months, by publish date

1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09

Exploited share: 0% vs 1% corpus
Median CVSS: 5.3
Publish → KEV: —
Last 90 days: 1 prev 1

Weakness classes

CWE-770 1

Products

github.com/quic-go/quic-go 3
github.com/quic-go/webtransport-go 1
webtransport-go 1

Follow quic-go:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

quic-go vulnerabilities

CVEs affecting quic-go, newest first. Open any entry for full detail, references, and exploit status.

5 CVEsRSS

CVE-2026-57497Medium· 5.3

1w ago

webtransport-go is an implementation of the WebTransport protocol

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, …

▾ Sunlitquic-go · webtransport-goEPSS 0.47%via NVD

CVE-2026-40898Medium· 5.3

3mo ago

quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion

▾ Sunlitquic-go · github.com/quic-go/quic-goEPSS 0.40%via OSV

CVE-2026-21438Medium· 5.3

7mo ago

webtransport-go: Memory Exhaustion Attack due to Missing Cleanup of Streams Map

▾ Sunlitquic-go · github.com/quic-go/webtransport-goEPSS 0.38%via OSV

CVE-2025-59530High· 7.5

11mo ago

quic-go: Panic occurs when queuing undecryptable packets after handshake completion

▾ Twilightquic-go · github.com/quic-go/quic-goEPSS 0.46%via OSV

CVE-2023-46239High· 7.5

2y ago

quic-go vulnerable to pointer dereference that can lead to panic

▾ Twilightquic-go · github.com/quic-go/quic-goEPSS 0.77%via OSV