GHSA-G754-HX8W-X2G6 quic-go HTTP/3 QPACK Header Expansion DoS

Summary An attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section many unique header names and/or large values. The implementation builds an http.Header used on th...

CVE-2025-64702: Allocation of Resources Without Limits or Throttling

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section many unique header...

PT-2025-54701

Summary An attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section many unique header names and/or large values. The implementation builds an http.Header used on th...

PT-2025-50733

Name of the Vulnerable Software and Affected Versions quic-go versions 0.56.0 and below Description quic-go, an implementation of the QUIC protocol in Go, is susceptible to excessive memory allocation. This occurs through the HTTP/3 client and server implementations when processing a QPACK-encode...

jetty: hpack header values cause denial of service in http/2

A flaw was found in Jetty http2-hpack and http3-qpack. If header values exceed the size limit and Huffman is the trueMetaDataBuilder.checkSize, the multiplication will overflow, and the length will become negative, causing a large buffer allocation on the server, leading to a Denial of Service Do...

jetty: hpack header values cause denial of service in http/2

A flaw was found in Jetty http2-hpack and http3-qpack. If header values exceed the size limit and Huffman is the trueMetaDataBuilder.checkSize, the multiplication will overflow, and the length will become negative, causing a large buffer allocation on the server, leading to a Denial of Service Do...

CVE-2023-36478

A flaw was found in Jetty http2-hpack and http3-qpack. If header values exceed the size limit and Huffman is the trueMetaDataBuilder.checkSize, the multiplication will overflow, and the length will become negative, causing a large buffer allocation on the server, leading to a Denial of Service Do...

com.infomaximum:network (>=1.1.3p8, <=1.1.3p10), com.infomaximum:platform (>=0.1.6p17, <=0.1.13p1) +11 more potentially affected by CVE-2023-36478 via org.eclipse.jetty.http3:http3-qpack (>=11.0.8, <=11.0.15)

org.eclipse.jetty.http3:http3-qpack MAVEN version =11.0.8, =1.1.3p8, =0.1.6p17, =0.2.0, =0.2.0, =0.2.0, =11.0.8, =11.0.8, =11.0.8, =11.0.8, =11.0.8, =11.0.8, =11.0.10, =11.0.15 Source cves: CVE-2023-36478 Source advisory: OSV:GHSA-WGH7-54F2-X98R...

org.eclipse.jetty.documentation:jetty-documentation (>=10.0.8, <=10.0.15), org.eclipse.jetty.http3:http3-client (>=10.0.8, <=10.0.15) +6 more potentially affected by CVE-2023-36478 via org.eclipse.jetty.http3:http3-qpack (>=10.0.8, <=10.0.15)

org.eclipse.jetty.http3:http3-qpack MAVEN version =10.0.8, =10.0.8, =10.0.8, =10.0.8, =10.0.8, =10.0.8, =10.0.8, =10.0.10, =5.26.1, =5.27.0 Source cves: CVE-2023-36478 Source advisory: GHSA-WGH7-54F2-X98R...

com.infomaximum:network (>=1.1.3p8, <=1.1.3p10), com.infomaximum:platform (>=0.1.6p17, <=0.1.13p1) +11 more potentially affected by CVE-2023-36478 via org.eclipse.jetty.http3:http3-qpack (>=11.0.8, <=11.0.15)

org.eclipse.jetty.http3:http3-qpack MAVEN version =11.0.8, =1.1.3p8, =0.1.6p17, =0.2.0, =0.2.0, =0.2.0, =11.0.8, =11.0.8, =11.0.8, =11.0.8, =11.0.8, =11.0.8, =11.0.10, =11.0.15 Source cves: CVE-2023-36478 Source advisory: GHSA-WGH7-54F2-X98R...