CVE-2025-59530 quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame
A malicious server can crash the quic-go client by sending a premature HANDSHAKE_DONE frame, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-59530?
CVE-2025-59530 is a high-severity denial of service vulnerability in quic-go, published on 10 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure, leading to a process crash. This requires no authentication and can be exploited during the handshake phase. This was observed in the wild with certain server implementations. quic-go needs to be able to handle misbehaving server implementations, including those that prematurely send a HANDSHAKE_DONE frame. Versions 0.49.0, 0.54.1, and 0.55.0 discard Initial keys when receiving a HANDSHAKE_DONE frame, thereby correctly handling premature HANDSHAKE_DONE frames.
Which versions are affected by CVE-2025-59530?
5 open source packages ship an affected version, including github.com/quic-go/quic-go.
| Package | Affected | Fixed in |
|---|---|---|
github.com/quic-go/quic-go Go | All versions | 0.49.1, 0.54.1 |
github.com/quic-go/quic-go Go | All versions | 0.49.1 |
github.com/quic-go/quic-go Go | All versions | 0.49.1 |
github.com/quic-go/quic-go Go | From 0.50.0 | 0.54.1 |
github.com/quic-go/quic-go Go | From 0.50.0 | 0.54.1 |
Linux distribution packages (17)
receptor Red Hat:ansible_automation_platform:2.4::el8 | All versions | 0:1.6.2-1.el8ap |
receptor-debuginfo Red Hat:ansible_automation_platform:2.4::el8 | All versions | 0:1.6.2-1.el8ap |
receptor-debugsource Red Hat:ansible_automation_platform:2.4::el8 | All versions | 0:1.6.2-1.el8ap |
receptorctl Red Hat:ansible_automation_platform:2.4::el8 | All versions | 0:1.6.2-1.el8ap |
receptor Red Hat:ansible_automation_platform:2.4::el9 | All versions | 0:1.6.2-1.el9ap |
receptor-debuginfo Red Hat:ansible_automation_platform:2.4::el9 | All versions | 0:1.6.2-1.el9ap |
receptor-debugsource Red Hat:ansible_automation_platform:2.4::el9 | All versions | 0:1.6.2-1.el9ap |
receptorctl Red Hat:ansible_automation_platform:2.4::el9 | All versions | 0:1.6.2-1.el9ap |
receptor Red Hat:ansible_automation_platform_developer:2.4::el8 | All versions | 0:1.6.2-1.el8ap |
receptorctl Red Hat:ansible_automation_platform_developer:2.4::el8 | All versions | 0:1.6.2-1.el8ap |
receptor Red Hat:ansible_automation_platform_developer:2.4::el9 | All versions | 0:1.6.2-1.el9ap |
receptorctl Red Hat:ansible_automation_platform_developer:2.4::el9 | All versions | 0:1.6.2-1.el9ap |
receptor Red Hat:ansible_automation_platform_inside:2.4::el8 | All versions | 0:1.6.2-1.el8ap |
receptorctl Red Hat:ansible_automation_platform_inside:2.4::el8 | All versions | 0:1.6.2-1.el8ap |
receptor Red Hat:ansible_automation_platform_inside:2.4::el9 | All versions | 0:1.6.2-1.el9ap |
receptorctl Red Hat:ansible_automation_platform_inside:2.4::el9 | All versions | 0:1.6.2-1.el9ap |
teleport openSUSE:Tumbleweed | All versions | 17.7.10-1.1 |
How do I fix CVE-2025-59530?
Upgrade github.com/quic-go/quic-go to a fixed version for your release line: 0.49.1 or 0.54.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-59530 being exploited?
There is no known exploitation of CVE-2025-59530 in the wild and no public exploit code.
Sources
Also known as AZL-68778, AZL-68781, CLEANSTART-2026-BK21255, CLEANSTART-2026-BR56941, CLEANSTART-2026-II99351, DEBIAN-CVE-2025-59530 and 24 more.