CVE-2025-64702: 
Trivy vulnerability analysis and mitigation

CVE-2025-64702 is a denial-of-service vulnerability in quic-go's HTTP/3 implementation caused by excessive memory allocation during QPACK header decompression. It affects all versions of github.com/quic-go/quic-go up to and including v0.56.0, impacting both HTTP/3 server and client implementations. The vulnerability was disclosed on December 11, 2025, by researcher sfoxio and fixed in v0.57.0. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, quic-go Security Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): quic-go enforced size limits only on the compressed QPACK-encoded HEADERS frame (defaulting to 1 MB for servers and 10 MB for clients), but not on the resulting decoded header field section. In HTTP/3, headers are compressed via QPACK (RFC 9204), and QPACK static table entries with long names/values can cause a crafted HEADERS frame to expand to approximately 50× its encoded size upon decoding. The implementation builds an http.Header object (used in http.Request and http.Response) without checking the cumulative decoded size, violating RFC 9114's requirement to enforce decoded field section size limits via SETTINGS_MAX_FIELD_SECTION_SIZE. The fix introduces incremental QPACK decoding with per-entry size accounting (name length + value length + 32 bytes overhead per RFC 9114 §4.2.2), aborting with HTTP 431 on the server side or a stream reset on the client side when the limit is exceeded (quic-go Security Advisory, Patch Commit).

Successful exploitation causes uncontrolled memory exhaustion on the target system, potentially leading to process crashes or complete service unavailability — a denial-of-service condition. The vulnerability symmetrically affects both HTTP/3 servers and clients, meaning a malicious server can also exploit connecting clients. There is no confidentiality or integrity impact; the sole consequence is availability loss (Github Advisory). Downstream products embedding quic-go, such as IBM watsonx Orchestrate Developer Edition and related cartridges, are also affected (IBM Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability requires no authentication, no privileges, and no user interaction — any network-accessible quic-go HTTP/3 endpoint is a valid target. The EPSS score is approximately 0.019% (5th percentile), indicating a low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify services running quic-go HTTP/3 (versions ≤ 0.56.0) using network scanning tools capable of QUIC/UDP discovery (e.g., zgrab2 with QUIC support, or Shodan queries for QUIC-enabled services).
2. Craft malicious HEADERS frame: Construct a QPACK-encoded HEADERS frame that stays within the server's compressed size limit (≤ 1 MB by default) but references QPACK static table entries with long names and/or large values, achieving a decoded expansion ratio of up to ~50×.
3. Establish QUIC connection: Initiate a QUIC connection to the target server on its HTTP/3 port (typically UDP/443).
4. Send crafted request: Transmit the malicious HEADERS frame as part of an HTTP/3 request. The server decodes the QPACK headers without enforcing a decoded size limit, triggering allocation of a large http.Header map in memory.
5. Repeat to exhaust memory: Send multiple such requests in rapid succession to amplify memory consumption, ultimately causing the server process to exhaust available memory and crash or become unresponsive (quic-go Security Advisory, Patch Commit).

• Network: Unusual volume of QUIC (UDP) connections to HTTP/3 endpoints; HEADERS frames near the configured compressed size limit arriving in rapid succession from one or few source IPs.
• Process/Runtime: Sudden spike in Go process memory (RSS/heap) for services using quic-go; out-of-memory (OOM) kills of HTTP/3 server or client processes; Go runtime panics related to memory allocation.
• Logs: Application logs showing repeated or unexpected stream resets or connection closures; after patching, logs may show HTTP 431 responses (Request Header Fields Too Large) or ErrCodeExcessiveLoad stream error codes indicating exploitation attempts against the patched version.

The primary remediation is to upgrade github.com/quic-go/quic-go to v0.57.0 or later, which enforces RFC 9114 decoded field section size limits via SETTINGS_MAX_FIELD_SECTION_SIZE and incremental QPACK decoding (quic-go Security Advisory, Patch Commit). IBM has also released patches for affected watsonx Orchestrate products (IBM Advisory). As a temporary workaround where immediate patching is not possible, deploy network-level controls (e.g., rate limiting on QUIC/UDP traffic, or blocking untrusted peers from reaching HTTP/3 endpoints) to reduce exposure.

The advisory was published by quic-go maintainer marten-seemann on December 11, 2025, crediting researcher sfoxio for the report (quic-go Security Advisory). The vulnerability received routine coverage from vulnerability tracking services (Tenable Nessus, Qualys, VulnDB) and was incorporated into downstream vendor advisories by IBM. No significant public researcher commentary or social media discussion has been identified beyond standard vulnerability database entries.