quic-go

Mentions · 7d2
Mentions · 30d2
All mentions2
First seenOct 22, 2026
Last mentioned3d ago

Timeline

2 articles · newest first

QPACK flaws let one HTTP/3 connection exhaust server memory

Seven of ten tested stacks were vulnerable; quic-go, quiche, lsquic and Wireshark had fixes as of October 20, 2026.

Lobsters · securityOct 22, 15:15 UTC · 3d agoVulnerability 3 sourcesCVE-2025-64702 CVE-2026-12523 CVE-2025-139451 · 1 read

QPACK flaws can crash HTTP/3 servers via memory amplification

FoxIO released PoCs; quic-go, quiche, lsquic, and Wireshark are patched, while Bun, h3, and aioquic were not.

The Hacker Newsupdated Oct 22, 15:15 UTC · 3d agofirst Oct 22, 06:38 UTC · 3d agoVulnerability 3 sourcesCVE-2025-64702 CVE-2026-12523 CVE-2025-139451 · 1 read

Related CVEs

by mentions

CVE-2026-12523<1%7.5
Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames
published Jul 14, 2026cloudflare quiche
CVE-2025-13945<1%5.5
HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows denial of service
published Dec 3, 2025wireshark wiresharkPoC ×2
CVE-2025-64702<1%5.3
quic-go is an implementation of the QUIC protocol in Go
published Dec 11, 2025quic-go project quic-goPoC

Appears with

lsquicproduct · 2
Cloudflarevendor · 2
quicheproduct · 2
h3product · 2
Bunproduct · 2
aioquicproduct · 2
Wiresharkvendor · 2
IISproduct · 1
LiteSpeedvendor · 1
mitmproxyproduct · 1
FoxIOorganization · 1
Envoyproduct · 1

Entities are extracted by the model from each article. First seen Oct 22, 2026, last mentioned 3d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.