CVE-2025-64702
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Dec 11, 2025
CISA due date
—
The record
quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/quic-go/quic-go | 0 | 0.57.0 |
| Chainguard | buf | 0 | 1.61.0-r2 |
| Chainguard | caddy | 0 | 2.10.2-r7 |
| Chainguard | caddy-fips | 0 | 2.10.2-r7 |
| Chainguard | caddy-man | 0 | 2.10.2-r7 |
| Chainguard | caddy-src | 0 | 2.10.2-r7 |
| Chainguard | coredns-1.12 | 0 | 1.12.4-r7 |
| Chainguard | coredns-1.12-compat | 0 | 1.12.4-r7 |
| Chainguard | coredns-fips-1.12 | 0 | 1.12.4-r7 |
| Chainguard | dkron | 0 | 4.0.8-r4 |
| Chainguard | dkron-compat | 0 | 4.0.8-r4 |
| Chainguard | dkron-executor-gcppubsub | 0 | 4.0.8-r4 |
| Chainguard | dkron-executor-gcppubsub-compat | 0 | 4.0.8-r4 |
| Chainguard | dkron-executor-grpc | 0 | 4.0.8-r4 |
| Chainguard | dkron-executor-grpc-compat | 0 | 4.0.8-r4 |
| Chainguard | dkron-executor-kafka | 0 | 4.0.8-r4 |
| Chainguard | dkron-executor-kafka-compat | 0 | 4.0.8-r4 |
| Chainguard | dkron-executor-nats | 0 | 4.0.8-r4 |
| Chainguard | dkron-executor-nats-compat | 0 | 4.0.8-r4 |
| Chainguard | dkron-executor-rabbitmq | 0 | 4.0.8-r4 |
| Chainguard | dkron-executor-rabbitmq-compat | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips-compat | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips-executor-gcppubsub | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips-executor-gcppubsub-compat | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips-executor-grpc | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips-executor-grpc-compat | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips-executor-kafka | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips-executor-kafka-compat | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips-executor-nats | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips-executor-nats-compat | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips-executor-rabbitmq | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips-executor-rabbitmq-compat | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips-processor-files | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips-processor-files-compat | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips-processor-fluent | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips-processor-fluent-compat | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips-processor-log | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips-processor-log-compat | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips-processor-syslog | 0 | 4.0.8-r4 |
| Chainguard | dkron-fips-processor-syslog-compat | 0 | 4.0.8-r4 |
| Chainguard | dkron-processor-files | 0 | 4.0.8-r4 |
| Chainguard | dkron-processor-files-compat | 0 | 4.0.8-r4 |
| Chainguard | dkron-processor-fluent | 0 | 4.0.8-r4 |
| Chainguard | dkron-processor-fluent-compat | 0 | 4.0.8-r4 |
| Chainguard | dkron-processor-log | 0 | 4.0.8-r4 |
| Chainguard | dkron-processor-log-compat | 0 | 4.0.8-r4 |
| Chainguard | dkron-processor-syslog | 0 | 4.0.8-r4 |
| Chainguard | dkron-processor-syslog-compat | 0 | 4.0.8-r4 |
| Chainguard | eks-distro-1.29 | 0 | 1.29.55-r1 |
| Chainguard | eks-distro-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-1.31 | 0 | 1.31.37-r0 |
| Chainguard | eks-distro-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-1.34 | 0 | 1.34.11-r1 |
| Chainguard | eks-distro-coredns-1.29 | 0 | 1.29.55-r1 |
| Chainguard | eks-distro-coredns-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-coredns-1.31 | 0 | 1.31.38-r0 |
| Chainguard | eks-distro-coredns-1.31 | 0 | 1.31.40-r0 |
| Chainguard | eks-distro-coredns-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-coredns-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-coredns-1.34 | 0 | 1.34.11-r1 |
| Chainguard | eks-distro-coredns-fips-1.29 | 0 | 1.29.56-r0 |
| Chainguard | eks-distro-coredns-fips-1.29 | 0 | 1.29.58-r0 |
| Chainguard | eks-distro-coredns-fips-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-coredns-fips-1.31 | 0 | 1.31.37-r1 |
| Chainguard | eks-distro-coredns-fips-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-coredns-fips-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-coredns-fips-1.34 | 0 | 1.34.11-r1 |
| Chainguard | eks-distro-fips-1.29 | 0 | 1.29.55-r0 |
| Chainguard | eks-distro-fips-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-fips-1.31 | 0 | 1.31.37-r1 |
| Chainguard | eks-distro-fips-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-fips-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-fips-1.34 | 0 | 1.34.11-r1 |
| Chainguard | eks-distro-kube-apiserver-1.29 | 0 | 1.29.55-r1 |
| Chainguard | eks-distro-kube-apiserver-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kube-apiserver-1.31 | 0 | 1.31.37-r0 |
| Chainguard | eks-distro-kube-apiserver-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kube-apiserver-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kube-apiserver-1.34 | 0 | 1.34.11-r1 |
| Chainguard | eks-distro-kube-apiserver-fips-1.29 | 0 | 1.29.55-r0 |
| Chainguard | eks-distro-kube-apiserver-fips-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kube-apiserver-fips-1.31 | 0 | 1.31.37-r1 |
| Chainguard | eks-distro-kube-apiserver-fips-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kube-apiserver-fips-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kube-apiserver-fips-1.34 | 0 | 1.34.11-r1 |
| Chainguard | eks-distro-kube-controller-manager-1.29 | 0 | 1.29.55-r1 |
| Chainguard | eks-distro-kube-controller-manager-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kube-controller-manager-1.31 | 0 | 1.31.37-r0 |
| Chainguard | eks-distro-kube-controller-manager-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kube-controller-manager-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kube-controller-manager-1.34 | 0 | 1.34.11-r1 |
| Chainguard | eks-distro-kube-controller-manager-fips-1.29 | 0 | 1.29.55-r0 |
| Chainguard | eks-distro-kube-controller-manager-fips-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kube-controller-manager-fips-1.31 | 0 | 1.31.37-r1 |
| Chainguard | eks-distro-kube-controller-manager-fips-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kube-controller-manager-fips-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kube-controller-manager-fips-1.34 | 0 | 1.34.11-r1 |
| Chainguard | eks-distro-kube-proxy-1.29 | 0 | 1.29.55-r1 |
| Chainguard | eks-distro-kube-proxy-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kube-proxy-1.31 | 0 | 1.31.37-r0 |
| Chainguard | eks-distro-kube-proxy-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kube-proxy-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kube-proxy-1.34 | 0 | 1.34.11-r1 |
| Chainguard | eks-distro-kube-proxy-fips-1.29 | 0 | 1.29.55-r0 |
| Chainguard | eks-distro-kube-proxy-fips-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kube-proxy-fips-1.31 | 0 | 1.31.37-r1 |
| Chainguard | eks-distro-kube-proxy-fips-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kube-proxy-fips-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kube-proxy-fips-1.34 | 0 | 1.34.11-r1 |
| Chainguard | eks-distro-kube-scheduler-1.29 | 0 | 1.29.55-r1 |
| Chainguard | eks-distro-kube-scheduler-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kube-scheduler-1.31 | 0 | 1.31.37-r0 |
| Chainguard | eks-distro-kube-scheduler-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kube-scheduler-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kube-scheduler-1.34 | 0 | 1.34.11-r1 |
| Chainguard | eks-distro-kube-scheduler-fips-1.29 | 0 | 1.29.55-r0 |
| Chainguard | eks-distro-kube-scheduler-fips-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kube-scheduler-fips-1.31 | 0 | 1.31.37-r1 |
| Chainguard | eks-distro-kube-scheduler-fips-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kube-scheduler-fips-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kube-scheduler-fips-1.34 | 0 | 1.34.11-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-attacher-1.29 | 0 | 1.29.55-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-attacher-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-attacher-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-attacher-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-attacher-fips-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-attacher-fips-1.31 | 0 | 1.31.37-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-attacher-fips-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-attacher-fips-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-provisioner-1.29 | 0 | 1.29.55-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-provisioner-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-provisioner-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-provisioner-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-provisioner-fips-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-provisioner-fips-1.31 | 0 | 1.31.37-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-provisioner-fips-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-provisioner-fips-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-resizer-1.29 | 0 | 1.29.55-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-resizer-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-resizer-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-resizer-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-resizer-fips-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-resizer-fips-1.31 | 0 | 1.31.37-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-resizer-fips-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-resizer-fips-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-controller-1.29 | 0 | 1.29.55-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-controller-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-controller-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-controller-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-controller-fips-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-controller-fips-1.31 | 0 | 1.31.37-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-controller-fips-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-controller-fips-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-validation-webhook-1.29 | 0 | 1.29.55-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-validation-webhook-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-validation-webhook-fips-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-validation-webhook-fips-1.31 | 0 | 1.31.37-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshotter-1.29 | 0 | 1.29.55-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshotter-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshotter-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshotter-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshotter-fips-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshotter-fips-1.31 | 0 | 1.31.37-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshotter-fips-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshotter-fips-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kubernetes-csi-livenessprobe-1.29 | 0 | 1.29.55-r1 |
| Chainguard | eks-distro-kubernetes-csi-livenessprobe-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kubernetes-csi-livenessprobe-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kubernetes-csi-livenessprobe-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kubernetes-csi-livenessprobe-fips-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kubernetes-csi-livenessprobe-fips-1.31 | 0 | 1.31.37-r1 |
| Chainguard | eks-distro-kubernetes-csi-livenessprobe-fips-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kubernetes-csi-livenessprobe-fips-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kubernetes-csi-node-driver-registrar-1.29 | 0 | 1.29.55-r1 |
| Chainguard | eks-distro-kubernetes-csi-node-driver-registrar-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kubernetes-csi-node-driver-registrar-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kubernetes-csi-node-driver-registrar-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kubernetes-csi-node-driver-registrar-fips-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kubernetes-csi-node-driver-registrar-fips-1.31 | 0 | 1.31.37-r1 |
| Chainguard | eks-distro-kubernetes-csi-node-driver-registrar-fips-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kubernetes-csi-node-driver-registrar-fips-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kubernetes-pause-1.29 | 0 | 1.29.55-r1 |
| Chainguard | eks-distro-kubernetes-pause-1.30 | 0 | 1.30.48-r1 |
| Chainguard | eks-distro-kubernetes-pause-1.31 | 0 | 1.31.37-r0 |
| Chainguard | eks-distro-kubernetes-pause-1.32 | 0 | 1.32.30-r1 |
| Chainguard | eks-distro-kubernetes-pause-1.33 | 0 | 1.33.20-r1 |
| Chainguard | eks-distro-kubernetes-pause-1.34 | 0 | 1.34.11-r1 |
| Chainguard | eks-distro-kubernetes-pause-compat-1.29 | 0 | 1.29.55-r1 |
| Chainguard | eks-distro-kubernetes-pause-compat-1.30 | 0 | 1.30.48-r1 |
| Chainguard | frp | 0 | 0.65.0-r5 |
| Chainguard | ipfs-cluster | 0 | 1.1.5-r5 |
| Chainguard | ipfs-cluster-compat | 0 | 1.1.4-r10 |
| Chainguard | ipfs-cluster-fips | 0 | 1.1.5-r4 |
| Chainguard | ipfs-cluster-fips-compat | 0 | 1.1.4-r7 |
| Chainguard | ipfs-cluster-fips-oci-entrypoint | 0 | 1.1.4-r7 |
| Chainguard | ipfs-cluster-oci-entrypoint | 0 | 1.1.5-r0 |
| Chainguard | k3s | 0 | 1.35.0.3-r0 |
| Chainguard | k3s-1.31 | 0 | 1.31.6.1-r13 |
Related vulnerabilities
- CVE-2024-53259 quic-go is an implementation of the QUIC protocol in Go. Also affects github.com/quic-go/quic-go
- CVE-2024-22189 quic-go is an implementation of the QUIC protocol in Go. Also affects github.com/quic-go/quic-go
- CVE-2026-27141 Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to… Also affects buf
- CVE-2025-4673 Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects… Also affects buf
- CVE-2025-22866 Due to the usage of a variable time instruction in the assembly implementation of an… Also affects buf
- CVE-2024-45338 An attacker can craft an input to the Parse functions that would be processed… Also affects buf
- CVE-2024-45337 Applications and libraries which misuse connection.serverAuthenticate (via callback field… Also affects buf
- CVE-2024-34155 Calling any of the Parse functions on Go source code which contains deeply nested… Also affects buf