QPACK flaws can crash HTTP/3 servers via memory amplification
FoxIO released PoCs; quic-go, quiche, lsquic, and Wireshark are patched, while Bun, h3, and aioquic were not.
72
CVE-2025-64702
- CVSS 3.1
- 5.3 medium
- EPSS
- <1%p61
- Published
- ·
- Modified
Description · NVD
quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.
- Vendors
- quic-go project
- Products
- quic-go
- Weakness
- CWE-770
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
In the news
2 storiesQPACK flaws let one HTTP/3 connection exhaust server memory
Seven of ten tested stacks were vulnerable; quic-go, quiche, lsquic and Wireshark had fixes as of October 20, 2026.
68