CVE catalog

CVE-2025-64702

golang-github-lucas-clemente-quic-go: CVE-2025-64702

Severity: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Dec 11, 2025, 8:58:10 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.92% · Oct 25, 2026

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	golang-github-lucas-clemente-quic-go	sid	`0.59.0-2`	fixed
Debian	golang-github-lucas-clemente-quic-go	forky	`0.59.0-2`	fixed
Debian	golang-github-lucas-clemente-quic-go	trixie	`0.50.1-2`	vulnerable
Debian	golang-github-lucas-clemente-quic-go	bookworm	`0.29.0-1`	vulnerable
Cpe	quic-go	Not reported	`0.57.0`	fixed
Opensuse	trivy	tumbleweed	`0.69.0-1.1`	fixed
Opensuse	teleport	tumbleweed	`17.7.13-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	golang-github-lucas-clemente-quic-go	source	sid	`0.59.0-1`	not yet assigned	Not reported	[1122814]
Debian	golang-github-lucas-clemente-quic-go	source	forky	`0.59.0-1`	not yet assigned	Not reported	[1122814]
Debian	golang-github-lucas-clemente-quic-go	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1122814]
Debian	golang-github-lucas-clemente-quic-go	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1122814]
Cpe	quic-go	cpe	Not reported	`0.57.0`	Not reported	NVD-CVE-2025-64702	Not reported
Opensuse	trivy	rpm	tumbleweed	`0.69.0-1.1`	Not reported	OPENSUSE-SU-2026:10131-1	Not reported
Opensuse	teleport	rpm	tumbleweed	`17.7.13-1.1`	Not reported	OPENSUSE-SU-2026:10035-1	Not reported

[Debian bug #1122814]

Notes

[trixie] golang-github-lucas-clemente-quic-go: Minor issue [bookworm] golang-github-lucas-clemente-quic-go: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[golang-github-lucas-clemente-quic-go-dev]Affected
Source package: [golang-github-lucas-clemente-quic-go]
Details (4)
- 0.29.0-1 · all · bookworm
  Affected
  dsa · golang-github-lucas-clemente-quic-go · debian · bookworm
- 0.29.0-1 · all · bookworm
  Affected
  dsa · golang-github-lucas-clemente-quic-go · debian · bookworm
- 0.46.0-2~bpo12+1 · all · bookworm-backports
  Affected
  dsa · golang-github-lucas-clemente-quic-go · debian · bookworm
- 0.46.0-2~bpo12+1 · all · bookworm-backports
  Affected
  dsa · golang-github-lucas-clemente-quic-go · debian · bookworm

[openSUSE Tumbleweed]

[teleport-bash-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.7.13-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-fdpass-teleport]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 17.7.13-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tbot]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 17.7.13-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tbot-bash-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.7.13-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tbot-zsh-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.7.13-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tctl]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 17.7.13-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tctl-bash-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.7.13-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tctl-zsh-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.7.13-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tsh]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 17.7.13-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tsh-bash-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.7.13-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tsh-zsh-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.7.13-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-zsh-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.7.13-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport]Fixed
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · x86_64 · tumbleweed
  Fixed · Fixed: 17.7.13-1.1
  dsa · teleport · opensuse · tumbleweed
[trivy]Fixed
Source package: [trivy]
Details (1)
- 0.74.0-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 0.69.0-1.1
  dsa · trivy · opensuse · tumbleweed

Observed: Oct 24, 2026, 8:18:17 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]