CVE-2025-59530 (CNNVD-202510-1438)
中文标题:
quic-go 安全漏洞
英文标题:
quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame
漏洞描述
中文描述:
quic-go是Lucas Clemente个人开发者的一种 QUIC 协议、RFC 9000协议在 Go 中的实现。 quic-go 0.49.0之前版本、0.54.1之前版本和0.55.0之前版本存在安全漏洞，该漏洞源于断言失败处理不当，可能导致拒绝服务攻击。
英文描述:
quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure, leading to a process crash. This requires no authentication and can be exploited during the handshake phase. This was observed in the wild with certain server implementations. quic-go needs to be able to handle misbehaving server implementations, including those that prematurely send a HANDSHAKE_DONE frame. Versions 0.49.0, 0.54.1, and 0.55.0 discard Initial keys when receiving a HANDSHAKE_DONE frame, thereby correctly handling premature HANDSHAKE_DONE frames.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| quic-go | quic-go | < 0.49.1 | - | - |
cpe:2.3:a:quic-go:quic-go:<_0.49.1:*:*:*:*:*:*:*
|
| quic-go | quic-go | >= 0.5.0, < 0.54.1 | - | - |
cpe:2.3:a:quic-go:quic-go:>=_0.5.0,_<_0.54.1:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (cna)
HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-59530 |
2025-11-11 15:23:31 | 2025-11-11 07:40:46 |
| NVD | nvd_CVE-2025-59530 |
2025-11-11 15:01:05 | 2025-11-11 07:48:33 |
| CNNVD | cnnvd_CNNVD-202510-1438 |
2025-11-11 15:12:28 | 2025-11-11 08:00:16 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202510-1438
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']