CVE-2025-64702
📋 TL;DR
quic-go versions 0.56.0 and below are vulnerable to memory exhaustion attacks through HTTP/3 QPACK header decoding. Attackers can send specially crafted HEADERS frames that cause excessive memory allocation, potentially leading to denial of service. This affects both HTTP/3 clients and servers using vulnerable quic-go implementations.
💻 Affected Systems
- quic-go
📦 What is this software?
Quic Go by Quic Go Project
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through memory exhaustion, causing denial of service and potential system instability.
Likely Case
Degraded performance or temporary service unavailability due to memory pressure from repeated attacks.
If Mitigated
Minimal impact with proper memory limits and monitoring in place.
🎯 Exploit Status
Attack requires sending HTTP/3 traffic but no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.57.0
Vendor Advisory: https://github.com/quic-go/quic-go/security/advisories/GHSA-g754-hx8w-x2g6
Restart Required: Yes
Instructions:
1. Update quic-go dependency to version 0.57.0 or higher. 2. Rebuild and redeploy affected applications. 3. Restart services using the updated library.
🔧 Temporary Workarounds
Implement HTTP header size limits
allAdd application-level validation to limit HTTP header sizes before processing.
Implement middleware or request validation to reject headers exceeding reasonable size limits
Rate limit HTTP/3 connections
allLimit connection rates to reduce impact of potential attacks.
Configure network or application firewalls to limit HTTP/3 connection rates
🧯 If You Can't Patch
- Implement network-level protections to filter or limit HTTP/3 traffic
- Deploy memory monitoring and alerting for abnormal allocation patterns
🔍 How to Verify
Check if Vulnerable:
Check go.mod or go.sum for quic-go dependency version 0.56.0 or below.Check Version:
go list -m github.com/quic-go/quic-goVerify Fix Applied:
Verify quic-go version is 0.57.0 or higher in dependency files and running application.📡 Detection & Monitoring
Log Indicators:
- Memory allocation spikes
- HTTP/3 connection errors
- Process restarts due to OOM
Network Indicators:
- Unusually large HTTP/3 HEADERS frames
- High volume of HTTP/3 connections
SIEM Query:
source="application_logs" AND ("out of memory" OR "memory allocation" OR "HTTP/3") AND severity>=WARNING