| Name | CVE-2025-59530 |
| Description | quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure, leading to a process crash. This requires no authentication and can be exploited during the handshake phase. This was observed in the wild with certain server implementations. quic-go needs to be able to handle misbehaving server implementations, including those that prematurely send a HANDSHAKE_DONE frame. Versions 0.49.0, 0.54.1, and 0.55.0 discard Initial keys when receiving a HANDSHAKE_DONE frame, thereby correctly handling premature HANDSHAKE_DONE frames. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| golang-github-lucas-clemente-quic-go (PTS) | bullseye | 0.19.3-1 | vulnerable |
| bookworm | 0.29.0-1 | vulnerable | |
| forky, trixie | 0.50.1-2 | vulnerable | |
| sid | 0.54.1-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| golang-github-lucas-clemente-quic-go | source | (unstable) | 0.54.1-1 |
[trixie] - golang-github-lucas-clemente-quic-go <no-dsa> (Minor issue)
[bookworm] - golang-github-lucas-clemente-quic-go <no-dsa> (Minor issue)
https://github.com/quic-go/quic-go/security/advisories/GHSA-47m2-4cr7-mhcw
https://github.com/quic-go/quic-go/pull/5354
Fixed by: https://github.com/quic-go/quic-go/commit/ce7c9ea8834b9d2ed79efa9269467f02c0895d42 (v0.55.0)
Fixed by: https://github.com/quic-go/quic-go/commit/0264fbc02e94a24370ff68005e02aa53f10add58 (v0.54.1)
Fixed by: https://github.com/quic-go/quic-go/commit/275c172fec2b4dae0eea5ac2052a28848b4363ea (v0.49.1)