quic-go vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20243
3. 20253
4. 20265

Newest CVEs

• CVE-2026-57497

  webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules

  quic-go · webtransport-go

  Medium5.3
• CVE-2026-40898

  quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion

  quic-go · quic-go

  Medium5.3
• CVE-2026-21438

  webtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams Map

  quic-go · webtransport-go

  Medium5.3
• CVE-2026-21435

  webtransport-go CloseWithError can block indefinitely

  quic-go · webtransport-go

  Medium5.3
• CVE-2026-21434

  webtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule

  quic-go · webtransport-go

  Medium5.3
• CVE-2025-64702

  quic-go HTTP/3 QPACK Header Expansion DoS

  quic-go · quic-go

  Medium5.3
• CVE-2025-59530

  quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame

  quic-go · quic-go

  High7.5
• CVE-2025-29785

  quic-go Has Panic in Path Probe Loss Recovery Handling

  quic-go · quic-go

  High7.5
• CVE-2024-53259

  quic-go affected by an ICMP Packet Too Large Injection Attack on Linux

  quic-go · quic-go

  Medium6.5
• CVE-2024-22189

  QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack

  quic-go · quic-go

  High7.5