- Published on
CVE-2025-64702: QUIC-Go QPACK Header Bomb
- Authors
- Name
- Alex Lee
- Title
- CEO
- @alexjoelee
What's the CVE?
quic-go versions 0.56.0 and earlier have a memory exhaustion bug. Send a QPACK-encoded HEADERS frame that unpacks into a huge header block (tons of unique names, giant values, or both). The library limits the compressed frame size but not the decompressed size. Result: you stuff http.Header until the box OOMs. Both client and server side affected.
How it works, short version:
Attacker crafts a QPACK HEADERS frame that's small on the wire. Decoder unpacks it. The decompressed headers are massive. quic-go builds an http.Header map from it. No cap on final size. Memory balloons. Server/agent dies. That's it. Indeed a classic decompression bomb, just aimed at HTTP/3 header blocks.
Are we affected?
No. We run Caddy v2.11 which ships with quic-go v0.57.0. v0.57.0 enforces limits on the decoded header set, not just the wire-encoded frame.
Maybe next time...