CVE-2025-59530Medium· 5.3▾ SunlitA denial of service flaw has been discovered in the quic-go golang library. A misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure, leading to a process crash. …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
0.4% → 0.5%
Last analysed / modified upstream
7.5 → 5.3
high → medium
A denial of service flaw has been discovered in the quic-go golang library. A misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure, leading to a process crash. This requires no authentication and can be exploited during the handshake phase. This was observed in the wild with certain server implementations.
github.com/quic-go/quic-go: quic-go Crash Due to Premature HANDSHAKE_DONE Frame — rated Moderate by Red Hat. Released 2025-10-10, updated 2026-09-26.
Affected:
Fixed:
No fix planned:
Not affected:
Red Hat Ansible Automation Platform https://access.redhat.com/errata/RHSA-2025:21706 Red Hat Ansible Automation Platform https://access.redhat.com/errata/RHSA-2025:23069 Red Hat Ansible Automation Platform https://access.redhat.com/errata/RHSA-2025:21768
Workarounds / mitigations:
Affected packages:
github.com/quic-go/quic-go < 0.49.1github.com/quic-go/quic-go >= 0.50.0, < 0.54.1Patched in:
github.com/quic-go/quic-go 0.49.1github.com/quic-go/quic-go 0.54.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-39373High· 7.5JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373)
CVE-2025-64460High· 7.5Django: Django: Algorithmic complexity in XML Deserializer leads to denial of service (CVE-2025-64460)
CVE-2025-6984High· 7.5langchain-community: Langchain-community insecure XML parsing (CVE-2025-6984)
CVE-2026-98874Low· 2.3kernel: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect (CVE-2026-98874)
CVE-2026-98872Medium· 4.4kernel: freevxfs: don't BUG() on unknown typed-extent type (CVE-2026-98872)
CVE-2026-101612Medium· 4.0mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101612)