CVE-2025-55181

Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually...

CVE-2025-55181

Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually...

PT-2025-48784

Name of the Vulnerable Software and Affected Versions proxygen affected versions not specified Description An excessively large HTTP request or response body—greater than 2^31 bytes—can cause an infinite loop within the proxygen::coro::HTTPQuicCoroSession component. This loop obstructs the event...

Google Chrome < 124.0.6367.60 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 124.0.6367.60. It is, therefore, affected by multiple vulnerabilities as referenced in the 202404stable-channel-update-for-desktop16 advisory. - Use after free in QUIC in Google Chrome prior to 124.0.6367.60 allowed a...

TencentOS Server 4: coredns (TSSA-2025:0485)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0485 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

github.com/quic-go/quic-go: quic-go Crash Due to Premature HANDSHAKE_DONE Frame

A denial of service flaw has been discovered in the quic-go golang library. A misbehaving or malicious server can cause a denial-of-service DoS attack on the quic-go client by triggering an assertion failure, leading to a process crash. This requires no authentication and can be exploited during...

RHEL 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Moderate) (RHSA-2025:21768)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21768 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Manage...

CLSA-2025-1763489872 runc: Fix of 3 CVEs

rebuild with newer golang to fix security vulnerabilities: - CVE-2023-45287: fix RSA-based TLS key exchange timing attack vulnerability - CVE-2024-24788: fix DNS resolver infinite loop causing denial of service - CVE-2023-39321: fix QUIC post-handshake message processing causing panic and denial...

github.com/quic-go/quic-go: quic-go Crash Due to Premature HANDSHAKE_DONE Frame

A denial of service flaw has been discovered in the quic-go golang library. A misbehaving or malicious server can cause a denial-of-service DoS attack on the quic-go client by triggering an assertion failure, leading to a process crash. This requires no authentication and can be exploited during...

Denial-of-Service (DoS)

quic-go is vulnerable to a Denial-Of-Service DoS. The vulnerability is due to improper handling of premature HANDSHAKEDONE frames during the QUIC handshake, where an assertion failure can be triggered by a misbehaving or malicious server, allowing attackers to crash the client process without...

Siemens SIMATIC S7-1500 Improper Certificate Validation (CVE-2024-2379)

libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems. This plugin only works wi...

SUSE CVE-2025-59530

quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service DoS attack on the quic-go client by triggering an assertion failure, leading to a process crash. This requires no authenticatio...

GO-2025-4017 Panic occurs when queuing undecryptable packets after handshake completion in github.com/quic-go/quic-go

Panic occurs when queuing undecryptable packets after handshake completion in github.com/quic-go/quic-go...

Security update for qatengine, qatlib

This update for qatengine, qatlib fixes the following issues: Note that the 1.6.1 release included in 1.7.0 fixes the following vulnerabilities: bsc1233363 CVE-2024-28885 bsc1233365 CVE-2024-31074 bsc1233366 CVE-2024-33617 Update to 1.7.0: ipp-crypto name change to cryptography-primitives QATSW G...

SUSE-SU-2025:3942-1 Security update for qatengine, qatlib

This update for qatengine, qatlib fixes the following issues: Note that the 1.6.1 release included in 1.7.0 fixes the following vulnerabilities: bsc1233363 CVE-2024-28885 bsc1233365 CVE-2024-31074 bsc1233366 CVE-2024-33617 Update to 1.7.0: ipp-crypto name change to cryptography-primitives QATSW G...

Security Bulletin: IBM Edge Data Collector uses ring-0.17.9.crate which is vulnerable to CVE-2025-4432.

Summary IBM Edge Data Collector uses ring-0.17.9.crate which is vulnerable to CVE-2025-4432. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2025-4432 DESCRIPTION: A flaw was found in Rust's Ring package. A panic may be triggered whe...

Fedora: Security Advisory (FEDORA-2025-16df491a66)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 43 : unbound (2025-16df491a66)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-16df491a66 advisory. Update to 1.24.1 - Enables DNS over QUIC server in unbound - Fix CVE-2025-11411, possible domain hijacking attack, reported by Yuxiao Wu, Yunyi Zhang, Baojun...

quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame

...

CVE-2025-59530

quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service DoS attack on the quic-go client by triggering an assertion failure, leading to a process crash. This requires no authenticatio...