CVE-2025-59530

What it actually does

A misbehaving QUIC server can send a premature HANDSHAKE_DONE frame during the handshake, triggering an assertion failure in the quic-go client that crashes the process.

Why it matters to the business

Client applications using the library experience unexpected crashes when connecting to certain servers, causing service disruption and loss of availability for users relying on QUIC-based connections.

How an attack unfolds

An attacker hosts or compromises a QUIC server that deliberately sends a HANDSHAKE_DONE frame before the handshake completes; when a vulnerable client initiates a connection, the assertion triggers and the client process terminates.

How to fix it

Upgrade quic-go to version 0.49.0, 0.54.1, or 0.55.0 (or the commit 275c172fec2b4dae0eea5ac2052a28848b4363ea) which discards Initial keys upon receiving HANDSHAKE_DONE to correctly handle premature frames.

How to confirm the fix worked

Verify the quic-go version in use matches a fixed release; test by connecting to a server that emits an early HANDSHAKE_DONE frame and confirm no assertion failure or crash occurs.

Typical attack path

1. Attacker controls or spoofs a QUIC server that sends premature HANDSHAKE_DONE frames
2. Vulnerable client initiates a QUIC connection to the server
3. Server transmits the invalid HANDSHAKE_DONE frame during the handshake
4. Client assertion fails and the process crashes

How to detect it

Inspect application and system logs for sudden process terminations during QUIC handshakes; correlate crashes with connection attempts to external or untrusted servers.

What your security team should do

• Prioritize upgrading all quic-go deployments to a patched version
• Review dependencies and rebuild affected applications with the fixed library
• Monitor client logs for unexpected QUIC handshake crashes until remediation is complete