{"cve":"CVE-2025-29785","nvd":{"published":"2025-06-02T11:15:21.953","modified":"2026-06-17T09:05:40.050","status":"Deferred","description":"quic-go is an implementation of the QUIC protocol in Go. The loss recovery logic for path probe packets that was added in the v0.50.0 release can be used to trigger a nil-pointer dereference by a malicious QUIC client. In order to do so, the attacker first sends valid QUIC packets from different remote addresses (thereby triggering the newly added path validation logic: the server sends path probe packets), and then sending ACKs for packets received from the server specifically crafted to trigger the nil-pointer dereference. v0.50.1 contains a patch that fixes the vulnerability. This release contains a test that generates random sequences of sent packets (both regular and path probe packets), that was used to verify that the patch actually covers all corner cases. No known workarounds are available.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-248"],"references":["https://github.com/quic-go/quic-go/commit/b90058aba5f65f48e0e150c89bbaa21a72dda4de","https://github.com/quic-go/quic-go/issues/4981","https://github.com/quic-go/quic-go/security/advisories/GHSA-j972-j939-p2v3"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:02:23.998251710+00:00"},"epss":{"cve":"CVE-2025-29785","score":0.00501,"percentile":0.42939,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-j972-j939-p2v3","url":"https://osv.dev/vulnerability/GHSA-j972-j939-p2v3","summary":"quic-go Has Panic in Path Probe Loss Recovery Handling","modified":"2025-06-04T20:57:25Z","packages":[{"ecosystem":"Go","name":"github.com/quic-go/quic-go","purl":"pkg:golang/github.com/quic-go/quic-go","ranges":[">=0.50.0 <0.50.1"],"fixed":["0.50.1"]}]},{"id":"GO-2025-3735","url":"https://osv.dev/vulnerability/GO-2025-3735","summary":"Panic in Path Probe Loss Recovery Handling in github.com/quic-go/quic-go","modified":"2025-06-03T17:58:43.215419Z","packages":[{"ecosystem":"Go","name":"github.com/quic-go/quic-go","purl":"pkg:golang/github.com/quic-go/quic-go","ranges":[">=0.50.0 <0.50.1"],"fixed":["0.50.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}