—
GO-2026-5676
HTTP/3 QPACK Trailer Expansion Memory Exhaustion in github.com/quic-go/quic-go
Details
HTTP/3 QPACK Trailer Expansion Memory Exhaustion in github.com/quic-go/quic-go
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/quic-go/quic-go
Introduced in:
0 Fixed in: 0.59.1 Fix
go get github.com/quic-go/quic-go@v0.59.1 References
- https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9 [ADVISORY]
- https://github.com/quic-go/quic-go/commit/c56e8c79d1627cc1ed6005b421b4b0adadd83665 [FIX]
- https://github.com/quic-go/quic-go/pull/5642 [FIX]
- https://github.com/advisories/GHSA-g754-hx8w-x2g6 [WEB]
- https://github.com/quic-go/quic-go/releases/tag/v0.59.1 [WEB]