CVE-2025-64702: Quic-go HTTP/3 DoS Vulnerability

CVE-2025-64702 Overview

CVE-2025-64702 affects quic-go, a Go implementation of the QUIC transport protocol. Versions 0.56.0 and earlier accept QPACK-encoded HTTP/3 HEADERS frames without limiting the size of the decoded header field section. A remote attacker can send a compressed frame that decompresses into many unique header names or oversized values, causing the client or server to allocate excessive memory when constructing the http.Header on http.Request and http.Response objects. This resource exhaustion condition maps to [CWE-770]. The maintainers fixed the issue in version 0.57.0.

Critical Impact
Unauthenticated remote attackers can trigger memory exhaustion in HTTP/3 clients and servers built on quic-go, degrading availability of dependent services.

Affected Products

quic-go versions 0.56.0 and below
HTTP/3 servers built on quic-go
HTTP/3 clients built on quic-go

Discovery Timeline

2025-12-11 - CVE-2025-64702 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64702

Vulnerability Analysis

The flaw exists in the HTTP/3 layer of quic-go. The implementation enforces a maxHeaderBytes limit on the compressed HEADERS frame length but not on the decompressed header field section. QPACK, defined in RFC 9204, uses static and dynamic tables that allow a small compressed payload to represent many large header fields. An attacker exploits this asymmetry by sending a small HEADERS frame that decodes into a large http.Header map. The server or client then allocates memory proportional to the decoded output while satisfying the compressed-size check.

Root Cause

The size check in http3/conn.go compared hf.Length (the compressed frame length) against maxHeaderBytes and permitted decompression to proceed. No accounting tracked cumulative bytes across decoded header names and values. This is a classic uncontrolled resource consumption defect [CWE-770] specific to compressed protocol formats.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP/3 requests or responses over QUIC to any endpoint using vulnerable quic-go versions. Repeated requests amplify the memory pressure and can force the process into out-of-memory termination. No authentication or user interaction is required.

 func (c *Conn) decodeTrailers(r io.Reader, streamID quic.StreamID, hf *headersFrame, maxHeaderBytes int) (http.Header, error) {
 	if hf.Length > uint64(maxHeaderBytes) {
 		maybeQlogInvalidHeadersFrame(c.qlogger, streamID, hf.Length)
-		return nil, fmt.Errorf("HEADERS frame too large: %d bytes (max: %d)", hf.Length, maxHeaderBytes)
+		return nil, fmt.Errorf("http3: HEADERS frame too large: %d bytes (max: %d)", hf.Length, maxHeaderBytes)
 	}
 
 	b := make([]byte, hf.Length)
// Source: https://github.com/quic-go/quic-go/commit/5b2d2129f8315da41e01eff0a847ab38a34e83a8

The patch also introduces errHeaderTooLarge in http3/headers.go to signal when the decoded header field section exceeds the configured limit. See the GitHub Security Advisory GHSA-g754-hx8w-x2g6 for full context.

Detection Methods for CVE-2025-64702

Indicators of Compromise

Rapid growth in resident set size (RSS) of Go processes serving or consuming HTTP/3 traffic.
Repeated inbound QUIC connections producing small HEADERS frames followed by large heap allocations.
Go runtime out-of-memory panics or runtime: out of memory log entries from HTTP/3 services.

Detection Strategies

Inventory Go binaries and modules to identify use of github.com/quic-go/quic-go at versions ≤ 0.56.0.
Instrument HTTP/3 endpoints with metrics capturing decoded header count and total header byte size per request.
Correlate QUIC/UDP 443 traffic spikes with process memory anomalies on affected hosts.

Monitoring Recommendations

Alert on sustained memory growth in HTTP/3-facing services and unexpected process restarts.
Log QPACK decoder errors and frame-size violations from quic-go at warning severity.
Track outbound HTTP/3 client behavior when consuming responses from untrusted origins.

How to Mitigate CVE-2025-64702

Immediate Actions Required

Upgrade quic-go to version 0.57.0 or later in all Go modules that import it.
Rebuild and redeploy any HTTP/3 client and server binaries linked against vulnerable versions.
Restrict exposure of HTTP/3 endpoints to trusted networks until patching is complete.

Patch Information

The fix landed in commit 5b2d2129f8315da41e01eff0a847ab38a34e83a8 and shipped in quic-go v0.57.0. The patch enforces a limit on the decoded header field section and returns errHeaderTooLarge when the limit is exceeded. Review the quic-go v0.57.0 patch commit for implementation details.

Workarounds

Place a reverse proxy in front of HTTP/3 services to enforce stricter request-header limits.
Disable HTTP/3 (Alt-Svc) advertisement and fall back to HTTP/2 until upgrades are deployed.
Apply operating-system memory limits (for example, systemdMemoryMax) to constrain blast radius.

bash

# Update quic-go dependency to a fixed release
go get github.com/quic-go/quic-go@v0.57.0
go mod tidy
go build ./...