What’s Vulnerable › Products

quic-go vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your quic-go version is affected

Latest quic-go vulnerabilities

• CVE-2026-40898 — quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion (CVSS 7.5)
• CVE-2025-64702 — quic-go HTTP/3 QPACK Header Expansion DoS (CVSS 5.3)
• CVE-2025-59530 — quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame (CVSS 7.5)
• CVE-2025-29785 — quic-go Has Panic in Path Probe Loss Recovery Handling (CVSS 7.5)
• CVE-2024-53259 — quic-go affected by an ICMP Packet Too Large Injection Attack on Linux (CVSS 6.5)
• CVE-2024-22189 — QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack (CVSS 7.5)
• CVE-2023-49295 — quic-go's path validation mechanism can cause denial of service (CVSS 6.5)
• CVE-2023-46239 — quic-go vulnerable to pointer dereference that can lead to panic (CVSS 7.5)
• CVE-2022-30591 — (CVSS 7.5)