quic-go

Records12All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high7CVSS 7.0–8.9

Exploited now

quic-go records in CISA KEV

No quic-go vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Webtransport-go 3 records LOW

Records

12 records

TI-2024-14782 CVE-2024-22189 · GHSA-c33x-xqrf-c478

QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack

MEDIUM 41

quic-go is an implementation of the QUIC protocol in Go.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01109 Published 2024-04-04 Partial fix · 0.42.0 CWE-770

TI-2023-24866 CVE-2023-46239 · GHSA-3q6m-v84f-6p9h

quic-go vulnerable to pointer dereference that can lead to panic

MEDIUM 41

quic-go is an implementation of the QUIC protocol in Go.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00956 Published 2023-10-31 Fixed in 0.37.3 CWE-248

TI-2026-29554 CVE-2026-40898 · GHSA-vvgj-x9jq-8cj9

quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion

LOW 39

quic-go is an implementation of the QUIC protocol in Go.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00396 Published 2026-06-04 Partial fix · 0.59.1 CWE-770

TI-2026-17320 CVE-2026-21435 · GHSA-px4r-g4p3-hhqv

webtransport-go CloseWithError can block indefinitely

LOW 39

webtransport-go is an implementation of the WebTransport protocol.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00465 Published 2026-02-12 Fixed in 0.10.0 CWE-400

TI-2026-17319 CVE-2026-21434 · GHSA-g6x7-jq8p-6q9q

webtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule

LOW 39

webtransport-go is an implementation of the WebTransport protocol.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00465 Published 2026-02-12 Fixed in 0.10.0 CWE-770

TI-2025-37061 CVE-2025-59530 · GHSA-47m2-4cr7-mhcw

quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame

LOW 39

quic-go is an implementation of the QUIC protocol in Go.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00465 Published 2025-10-10 Partial fix · 0.49.1, 0.54.1 CWE-617

TI-2025-21196 CVE-2025-29785 · GHSA-j972-j939-p2v3

quic-go Has Panic in Path Probe Loss Recovery Handling

LOW 39

quic-go is an implementation of the QUIC protocol in Go.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00501 Published 2025-06-02 Fixed in 0.50.1 CWE-248

TI-2025-40048 CVE-2025-64702 · GHSA-g754-hx8w-x2g6

quic-go HTTP/3 QPACK Header Expansion DoS

LOW 32

quic-go is an implementation of the QUIC protocol in Go.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00917 Published 2025-12-11 Partial fix · 0.57.0 CWE-770

TI-2026-41401 CVE-2026-57497 · GHSA-g35j-m5xg-vh3q

webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules

LOW 31

webtransport-go is an implementation of the WebTransport protocol.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00524 Published 2026-09-14 Fixed in 0.11.1 CWE-770

TI-2023-26931 CVE-2023-49295 · GHSA-ppxx-5m9h-6vxf

quic-go's path validation mechanism can cause denial of service

LOW 31

quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01204 Published 2024-01-10 Partial fix · 0.39.4, 0.38.2 +2 CWE-400

TI-2026-17323 CVE-2026-21438 · GHSA-2f2x-8mwp-p2gc

webtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams Map

LOW 30

webtransport-go is an implementation of the WebTransport protocol.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00412 Published 2026-02-12 Fixed in 0.10.0 CWE-401

TI-2024-35722 CVE-2024-53259 · GHSA-px8v-pp82-rcvr

quic-go affected by an ICMP Packet Too Large Injection Attack on Linux

LOW 30

quic-go is an implementation of the QUIC protocol in Go.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00604 Published 2024-12-02 Partial fix · 0.48.2 CWE-345

Open these records in search →

Critical	0
High	7
Medium	5
Low	0
No CVSS	0