golang-github-lucas-clemente-quic-go: quic-go is an implementation of the QUIC protocol in Go
CVE-2025-64702 is fixed in 5 products on 1 platform, first by DEBIAN-CVE-2025-64702, released December 11, 2025. It is not reported as exploited. Patch Radar priority: Routine.
quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| caddy · Fedora 43 | 2.10.2-9.fc43 | FEDORA-2026-3DC324BD9A | Jun 23, 2026 |
| caddy-debuginfo · Fedora 43 | 2.10.2-9.fc43 | FEDORA-2026-3DC324BD9A | Jun 23, 2026 |
| caddy-debugsource · Fedora 43 | 2.10.2-9.fc43 | FEDORA-2026-3DC324BD9A | Jun 23, 2026 |
| golang-github-lucas-clemente-quic-go · Debian 14 | 0.59.0-1 | DEBIAN-CVE-2025-64702 | Dec 11, 2025 |
| govulncheck-vulndb · opensuse-leap 15.6 | 0.0.20251230T014957-150000.1.134.1 | SUSE-SU-2026:0037-1 | Jan 6, 2026 |
| govulncheck-vulndb · opensuse-leap 16.0 | 0.0.20260723T184607-160000.1.1 | OPENSUSE-SU-2026:21483-1 | Jul 30, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.