Quic-go vulnerabilities
We track 7 vulnerabilities in Quic-go products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on June 4, 2026.
Latest Quic-go vulnerabilities
- 7.5 High severity
quic-go: Allocation of Resources Without Limits or Throttling
quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer
- 7.5 High severity
webtransport-go: Uncontrolled Resource Consumption
webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow contr
- 7.5 High severity
webtransport-go: Allocation of Resources Without Limits or Throttling
webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive memory consumption in webtransport-go's session implementation by sending a WT_CLOSE_SESSION capsule containing an excessively large Applica
- 7.5 High severity
quic-go: Reachable Assertion
quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure, leading to a proces
- 7.5 High severity
quic-go: Uncaught Exception
quic-go is an implementation of the QUIC protocol in Go. The loss recovery logic for path probe packets that was added in the v0.50.0 release can be used to trigger a nil-pointer dereference by a malicious QUIC client. In order to do so, the attacker first sen
- 7.5 High severity
quic-go: Allocation of Resources Without Limits or Throttling
quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to ea
- 7.5 High severity
quic-go: NULL Pointer Dereference
quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (l