chore(deps): update module github.com/quic-go/quic-go to v0.57.0 [security] #56
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/go-github.com-quic-go-quic-go-vulnerability"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
v0.56.0→v0.57.0quic-go HTTP/3 QPACK Header Expansion DoS
CVE-2025-64702 / GHSA-g754-hx8w-x2g6 / GO-2025-4233
More information
Details
Summary
An attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an
http.Header(used on thehttp.Requestandhttp.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion.Impact
A misbehaving or malicious peer can cause a denial-of-service (DoS) attack on quic-go's HTTP/3 servers or clients by triggering excessive memory allocation, potentially leading to crashes or exhaustion. It affects both servers and clients due to symmetric header construction.
Details
In HTTP/3, headers are compressed using QPACK (RFC 9204). quic-go's HTTP/3 server (and client) decodes the QPACK-encoded HEADERS frame into header fields, then constructs an http.Request (or response).
http3.Server.MaxHeaderBytesandhttp3.Transport.MaxResponseHeaderBytes, respectively, limit encoded HEADERS frame size (default: 1 MB server, 10 MB client), but not decoded size. A maliciously crafted HEADERS frame can expand to ~50x the encoded size using QPACK static table entries with long names / values.RFC 9114 requires enforcing decoded field section size limits via SETTINGS, which quic-go did not do.
The Fix
quic-go now enforces RFC 9114 decoded field section size limits, sending SETTINGS_MAX_FIELD_SECTION_SIZE and using incremental QPACK decoding to check the header size after each entry, aborting early on violations with HTTP 431 (on the server side) and stream reset (on the client side).
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
HTTP/3 QPACK Header Expansion DoS in github.com/quic-go/quic-go
CVE-2025-64702 / GHSA-g754-hx8w-x2g6 / GO-2025-4233
More information
Details
HTTP/3 QPACK Header Expansion DoS in github.com/quic-go/quic-go
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Release Notes
quic-go/quic-go (github.com/quic-go/quic-go)
v0.57.0Compare Source
This release contains a fix for CVE-2025-64702 by reworking the HTTP/3 header processing logic:
Breaking Changes
Transport.MaxResponseBytesis now anint(before:int64): #5433Notable Fixes
What's Changed
New Contributors
Full Changelog: https://github.com/quic-go/quic-go/compare/v0.56.0...v0.57.0
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.
ℹ️ Artifact update notice
File name: go.mod
In order to perform the update(s) described in the table above, Renovate ran the
go getcommand, which resulted in the following additional change(s):Details:
github.com/quic-go/qpackv0.5.1->v0.6.0a151c78839to581c23668aView command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.