Executive brief
HTTP/3 QPACK Header Expansion DoS in github.com/quic-go/quic-go
Affected products
- Go github.com/quic-go/quic-go
Junglewise Threat Intelligence
CVE-2025-64702: GO-2025-4233 - HTTP/3 QPACK Header Expansion DoS in github.com/quic-go/quic-go
CVE-2025-64702 · Severity: low · CVSS 3.1 · Published 2025-12-15
Technologies: github.com/quic-go/quic-go (Go). Vendors: Go.
Related threats
- quic-go memory exhaustion in HTTP/3 trailers
- GO-2025-4017 - Panic occurs when queuing undecryptable packets after handshake completion in github.com/quic-go/quic-go
- GO-2025-3735 - Panic in Path Probe Loss Recovery Handling in github.com/quic-go/quic-go
- GO-2024-3302 - ICMP Packet Too Large Injection Attack on Linux in github.com/quic-go/quic-go
- GO-2024-2682 - Denial of service via connection starvation in github.com/quic-go/quic-go