CVE-2025-59530
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-59530
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-59530.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-59530
- Aliases
- Downstream
- Related
- Published
- 2025-10-10T16:09:55Z
- Modified
- 2025-10-10T19:57:45.503268Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame
- Details
-
quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure, leading to a process crash. This requires no authentication and can be exploited during the handshake phase. This was observed in the wild with certain server implementations. quic-go needs to be able to handle misbehaving server implementations, including those that prematurely send a HANDSHAKEDONE frame. Versions 0.49.0, 0.54.1, and 0.55.0 discard Initial keys when receiving a HANDSHAKEDONE frame, thereby correctly handling premature HANDSHAKE_DONE frames.
- References
Affected packages
Git / github.com/quic-go/quic-go
Affected ranges
- Type
- GIT
- Repo
- https://github.com/quic-go/quic-go
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Type
- GIT
- Repo
- https://github.com/quic-go/quic-go
- Events
Affected versions
v.*
v.0.21
v0.*
v0.21.0
v0.21.1
v0.22.0
v0.23.0
v0.24.0
v0.25.0
v0.26.0
v0.27.0
v0.28.0
v0.28.1
v0.29.0
v0.30.0
v0.31.0
v0.31.1
v0.32.0
v0.33.0
v0.34.0
v0.35.0
v0.35.1
v0.36.0
v0.37.0
v0.37.1
v0.38.0
v0.38.1
v0.39.0
v0.4
v0.40.0
v0.41.0
v0.42.0
v0.43.0
v0.44.0
v0.45.0
v0.46.0
v0.47.0
v0.48.0
v0.48.1
v0.49.0
v0.5.0
v0.50.0
v0.51.0
v0.52.0
v0.53.0
v0.54.0
v0.6.0
v0.7.0