CVE catalog

CVE-2025-59530

golang-github-lucas-clemente-quic-go: CVE-2025-59530

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.46% · Oct 25, 2026

quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure, leading to a process crash. This requires no authentication and can be exploited during the handshake phase. This was observed in the wild with certain server implementations. quic-go needs to be able to handle misbehaving server implementations, including those that prematurely send a HANDSHAKE_DONE frame. Versions 0.49.0, 0.54.1, and 0.55.0 discard Initial keys when receiving a HANDSHAKE_DONE frame, thereby correctly handling premature HANDSHAKE_DONE frames.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-lucas-clemente-quic-gosid0.59.0-2fixed
Debiangolang-github-lucas-clemente-quic-goforky0.59.0-2fixed
Debiangolang-github-lucas-clemente-quic-gotrixie0.50.1-2vulnerable
Debiangolang-github-lucas-clemente-quic-gobookworm0.29.0-1vulnerable
Ubuntugolang-github-lucas-clemente-quic-go22.040.18.0-3vulnerable
Ubuntugolang-github-lucas-clemente-quic-go22.040.24.0-1vulnerable
Ubuntugolang-github-lucas-clemente-quic-go22.040.25.0-1vulnerable
Ubuntugolang-github-lucas-clemente-quic-go24.040.37.4-1vulnerable
Ubuntugolang-github-lucas-clemente-quic-go24.040.38.2-1vulnerable
Ubuntugolang-github-lucas-clemente-quic-go25.100.50.0-1vulnerable
Ubuntugolang-github-lucas-clemente-quic-go25.100.50.1-2vulnerable
Ubuntugolang-github-lucas-clemente-quic-go26.040.50.1-2vulnerable
Ubuntugolang-github-lucas-clemente-quic-go26.040.59.0-2vulnerable
Opensuseteleporttumbleweed17.7.10-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-lucas-clemente-quic-gosourcesid0.54.1-1not yet assignedNot reportedNot reported
Debiangolang-github-lucas-clemente-quic-gosourceforky0.54.1-1not yet assignedNot reportedNot reported
Debiangolang-github-lucas-clemente-quic-gosourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiangolang-github-lucas-clemente-quic-gosourcebookworm(unfixed)not yet assignedNot reportedNot reported
Opensuseteleportrpmtumbleweed17.7.10-1.1Not reportedOPENSUSE-SU-2025:15737-1Not reported

Notes

[trixie] golang-github-lucas-clemente-quic-go: Minor issue [bookworm] golang-github-lucas-clemente-quic-go: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-lucas-clemente-quic-go-dev]Affected

    Source package: [golang-github-lucas-clemente-quic-go]

    Details (4)

    • 0.29.0-1 · all · bookworm

      Affected

      dsa · golang-github-lucas-clemente-quic-go · debian · bookworm; dsa · golang-github-lucas-clemente-quic-go · debian · 12

    • 0.29.0-1 · all · bookworm

      Affected

      dsa · golang-github-lucas-clemente-quic-go · debian · bookworm; dsa · golang-github-lucas-clemente-quic-go · debian · 12

    • 0.46.0-2~bpo12+1 · all · bookworm-backports

      Affected

      dsa · golang-github-lucas-clemente-quic-go · debian · bookworm; dsa · golang-github-lucas-clemente-quic-go · debian · 12

    • 0.46.0-2~bpo12+1 · all · bookworm-backports

      Affected

      dsa · golang-github-lucas-clemente-quic-go · debian · bookworm; dsa · golang-github-lucas-clemente-quic-go · debian · 12

[Debian 13 (Trixie)]

  • [golang-github-lucas-clemente-quic-go-dev]Affected

    Source package: [golang-github-lucas-clemente-quic-go]

    Details (4)

    • 0.50.1-2 · all · trixie

      Affected

      dsa · golang-github-lucas-clemente-quic-go · debian · 13

    • 0.50.1-2 · all · trixie

      Affected

      dsa · golang-github-lucas-clemente-quic-go · debian · 13

    • 0.59.0-2~bpo13+1 · all · trixie-backports

      Affected

      dsa · golang-github-lucas-clemente-quic-go · debian · 13

    • 0.59.0-2~bpo13+1 · all · trixie-backports

      Affected

      dsa · golang-github-lucas-clemente-quic-go · debian · 13

[openSUSE Tumbleweed]

  • [teleport-bash-completion]Unknown

    Source package: [teleport]

    Details (1)

    • 17.7.26-1.3 · noarch · tumbleweed

      Unknown · Fixed: 17.7.10-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • [teleport-fdpass-teleport]Unknown

    Source package: [teleport]

    Details (1)

    • 17.7.26-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 17.7.10-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • [teleport-tbot]Unknown

    Source package: [teleport]

    Details (1)

    • 17.7.26-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 17.7.10-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • [teleport-tbot-bash-completion]Unknown

    Source package: [teleport]

    Details (1)

    • 17.7.26-1.3 · noarch · tumbleweed

      Unknown · Fixed: 17.7.10-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • [teleport-tbot-zsh-completion]Unknown

    Source package: [teleport]

    Details (1)

    • 17.7.26-1.3 · noarch · tumbleweed

      Unknown · Fixed: 17.7.10-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • [teleport-tctl]Unknown

    Source package: [teleport]

    Details (1)

    • 17.7.26-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 17.7.10-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • [teleport-tctl-bash-completion]Unknown

    Source package: [teleport]

    Details (1)

    • 17.7.26-1.3 · noarch · tumbleweed

      Unknown · Fixed: 17.7.10-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • [teleport-tctl-zsh-completion]Unknown

    Source package: [teleport]

    Details (1)

    • 17.7.26-1.3 · noarch · tumbleweed

      Unknown · Fixed: 17.7.10-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • [teleport-tsh]Unknown

    Source package: [teleport]

    Details (1)

    • 17.7.26-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 17.7.10-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • [teleport-tsh-bash-completion]Unknown

    Source package: [teleport]

    Details (1)

    • 17.7.26-1.3 · noarch · tumbleweed

      Unknown · Fixed: 17.7.10-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • [teleport-tsh-zsh-completion]Unknown

    Source package: [teleport]

    Details (1)

    • 17.7.26-1.3 · noarch · tumbleweed

      Unknown · Fixed: 17.7.10-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • [teleport-zsh-completion]Unknown

    Source package: [teleport]

    Details (1)

    • 17.7.26-1.3 · noarch · tumbleweed

      Unknown · Fixed: 17.7.10-1.1

      Version impact unknown

      dsa · teleport · opensuse · tumbleweed

  • [teleport]Fixed

    Source package: [teleport]

    Details (1)

    • 17.7.26-1.3 · x86_64 · tumbleweed

      Fixed · Fixed: 17.7.10-1.1

      dsa · teleport · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]