CVE-2025-29785
quic-go Has Panic in Path Probe Loss Recovery Handling
Reported by github_m · Published June 2, 2025
github.com/quic-go/quic-go is fixed in 0.50.1 (Go Modules)
quic-go is an implementation of the QUIC protocol in Go. The loss recovery logic for path probe packets that was added in the v0.50.0 release can be used to trigger a nil-pointer dereference by a malicious QUIC client. In order to do so, the attacker first sends valid QUIC packets from different remote addresses (thereby triggering the newly added path validation logic: the server sends path probe packets), and then sending ACKs for packets received from the server specifically crafted to trigger the nil-pointer dereference. v0.50.1 contains a patch that fixes the vulnerability. This release contains a test that generates random sequences of sent packets (both regular and path probe packets), that was used to verify that the patch actually covers all corner cases. No known workarounds are available.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| github.com/quic-go/quic-go | Go Modules | 0.50.1 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| quic-go | quic-go | = 0.50.0 |
| quic-go | quic-go | 0.50.0 |
| github.com | quic-go/quic-go | 0.50.0 |
Timeline
- Jun 2, 2025 EPSS Score (30 in total, the first dated here)
- Jun 2, 2025 Coalition ESS Score (9 in total, the first dated here)
- Jun 2, 2025 CVE Published
- Jun 2, 2025 PoC Published (2 in total, the first dated here)
- Jun 4, 2025 CVE Updated
- Dec 18, 2025 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-29785
vulnetix vdb fixes CVE-2025-29785Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-29785/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/quic-go/quic-go/security/advisories/GHSA-j972-j939-p2v3 x_refsource_CONFIRM
- https://github.com/quic-go/quic-go/issues/4981 x_refsource_MISC
- https://github.com/quic-go/quic-go/commit/b90058aba5f65f48e0e150c89bbaa21a72dda4de x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2025-29785 advisory
- https://github.com/advisories/GHSA-j972-j939-p2v3 advisory
- https://github.com/quic-go/quic-go url