Quic-Go

11 CVEs across 2 Quic-Go products. Browse Quic-Go vulnerabilities, severities, and proof-of-concept exploits.

Quic-Go products with known CVEs

ProductCVEs
Quic-Go8
Webtransport-Go3
Quic-Go CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-40898Medium5.32026-06-04quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client…
CVE-2026-21438Medium5.32026-02-12webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and…
CVE-2026-21435Medium5.32026-02-12webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing…
CVE-2026-21434Medium5.32026-02-12webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive memory consumption in webtransport-go's…
CVE-2025-64702Medium5.32025-12-11quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 clien…
CVE-2025-59530High7.52025-10-10quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-…
CVE-2025-29785High7.52025-06-02quic-go is an implementation of the QUIC protocol in Go. The loss recovery logic for path probe packets that was added in the v0.50.0 release can be used to tr…
CVE-2024-53259Medium6.52024-12-02quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used…
CVE-2024-22189High7.52024-04-04quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of…
CVE-2023-49295Medium6.42024-01-10quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a large num…
CVE-2023-46239High7.52023-10-31quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO t…