golang-github-lucas-clemente-quic-go - Debian Package Tracker

general

source: golang-github-lucas-clemente-quic-go (main)
version: 0.59.0-2
maintainer: Debian Go Packaging Team (DMD)
uploaders: John Goerzen [DMD] – Alexandre Viau [DMD] – Roger Shimizu [DMD] – Aloïs Micard [DMD]
arch: all
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.19.3-1
oldstable: 0.29.0-1
old-bpo: 0.46.0-2~bpo12+1
stable: 0.50.1-2
stable-bpo: 0.59.0-2~bpo13+1
testing: 0.59.0-2
unstable: 0.59.0-2
exp: 0.64.1-1

versioned links

0.19.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.29.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.46.0-2~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.50.1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.59.0-2~bpo13+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.59.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.64.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

golang-github-lucas-clemente-quic-go-dev

action needed

Debci reports failed tests high

unstable: fail (log)
The tests ran in 0:02:07
Last run: 2026-08-17T12:29:17.000Z
Previous status: unknown

testing: tmpfail (log)
The tests ran in an unknown time
Last run: 2026-09-15T18:21:43.055Z
Previous status: unknown

stable: pass (log)
The tests ran in 0:01:52
Last run: 2026-07-16T06:43:52.000Z
Previous status: unknown

Created: 2026-08-17 Last update: 2026-10-23 09:34

A new upstream version is available: 0.64.1 high

A new upstream version 0.64.1 is available, you should consider packaging it.

Created: 2026-05-14 Last update: 2026-10-23 05:00

The VCS repository is not up to date, push the missing commits. high

vcswatch reports that the current version of the package is not in its VCS.
Either you need to push your commits and/or your tags, or the information about the package's VCS are out of date. A common cause of the latter issue when using the Git VCS is not specifying the correct branch when the packaging is not in the default one (remote HEAD branch), which is usually "master" but can be modified in salsa.debian.org in the project's general settings with the "Default Branch" field). Alternatively the Vcs-Git field in debian/control can contain a "-b <branch-name>" suffix to indicate what branch is used for the Debian packaging.

Created: 2026-10-21 Last update: 2026-10-21 16:04

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-40898: quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or large values. The implementation builds an `http.Header` for the corresponding `http.Request` or `http.Response`, while only enforcing limits on the size of the QPACK-compressed HEADERS frame, not on the decoded field section. This can lead to memory exhaustion. This is very similar to CVE-2025-64702. The difference is that this issue uses HTTP trailers, rather than HTTP headers, as the attack vector. A misbehaving or malicious peer can cause a denial-of-service (DoS) attack against quic-go's HTTP/3 servers or clients by triggering excessive memory allocation, potentially leading to crashes or resource exhaustion. This affects both servers and clients due to symmetric header construction. Version 0.59.1 enforces RFC 9114 decoded field section size limits for trailers as well. It incrementally decodes QPACK entries and checks the field section size after each entry, aborting the stream if an entry causes the limit to be exceeded.

Created: 2026-06-05 Last update: 2026-09-01 22:00

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-40898: quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or large values. The implementation builds an `http.Header` for the corresponding `http.Request` or `http.Response`, while only enforcing limits on the size of the QPACK-compressed HEADERS frame, not on the decoded field section. This can lead to memory exhaustion. This is very similar to CVE-2025-64702. The difference is that this issue uses HTTP trailers, rather than HTTP headers, as the attack vector. A misbehaving or malicious peer can cause a denial-of-service (DoS) attack against quic-go's HTTP/3 servers or clients by triggering excessive memory allocation, potentially leading to crashes or resource exhaustion. This affects both servers and clients due to symmetric header construction. Version 0.59.1 enforces RFC 9114 decoded field section size limits for trailers as well. It incrementally decodes QPACK entries and checks the field section size after each entry, aborting the stream if an entry causes the limit to be exceeded.

Created: 2026-06-05 Last update: 2026-09-01 22:00

3 low-priority security issues in trixie low

There are 3 open security issues in trixie.

3 issues left for the package maintainer to handle:

CVE-2025-59530: (needs triaging) quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure, leading to a process crash. This requires no authentication and can be exploited during the handshake phase. This was observed in the wild with certain server implementations. quic-go needs to be able to handle misbehaving server implementations, including those that prematurely send a HANDSHAKE_DONE frame. Versions 0.49.0, 0.54.1, and 0.55.0 discard Initial keys when receiving a HANDSHAKE_DONE frame, thereby correctly handling premature HANDSHAKE_DONE frames.
CVE-2025-64702: (needs triaging) quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.
CVE-2026-40898: (needs triaging) quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or large values. The implementation builds an `http.Header` for the corresponding `http.Request` or `http.Response`, while only enforcing limits on the size of the QPACK-compressed HEADERS frame, not on the decoded field section. This can lead to memory exhaustion. This is very similar to CVE-2025-64702. The difference is that this issue uses HTTP trailers, rather than HTTP headers, as the attack vector. A misbehaving or malicious peer can cause a denial-of-service (DoS) attack against quic-go's HTTP/3 servers or clients by triggering excessive memory allocation, potentially leading to crashes or resource exhaustion. This affects both servers and clients due to symmetric header construction. Version 0.59.1 enforces RFC 9114 decoded field section size limits for trailers as well. It incrementally decodes QPACK entries and checks the field section size after each entry, aborting the stream if an entry causes the limit to be exceeded.

You can find information about how to handle these issues in the security team's documentation.

Created: 2025-10-12 Last update: 2026-09-01 22:00

debian/patches: 2 patches to forward upstream low

Among the 3 debian patches available in version 0.59.0-2 of the package, we noticed the following issues:

2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2026-03-03 Last update: 2026-03-04 10:02

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.3).

Created: 2026-03-31 Last update: 2026-03-31 15:01

news

[rss feed]

[2026-10-21] Accepted golang-github-lucas-clemente-quic-go 0.64.1-1 (source) into experimental (Simon Josefsson)
[2026-05-30] Accepted golang-github-lucas-clemente-quic-go 0.59.0-2~bpo13+1 (source all) into stable-backports (Debian FTP Masters) (signed by: Praveen Arimbrathodiyil)
[2026-03-09] golang-github-lucas-clemente-quic-go 0.59.0-2 MIGRATED to testing (Debian testing watch)
[2026-03-03] Accepted golang-github-lucas-clemente-quic-go 0.59.0-2 (source) into unstable (Dr. Tobias Quathamer)
[2026-03-02] Accepted golang-github-lucas-clemente-quic-go 0.59.0-1 (source) into unstable (Dr. Tobias Quathamer)
[2025-11-12] golang-github-lucas-clemente-quic-go 0.55.0-1 MIGRATED to testing (Debian testing watch)
[2025-11-06] Accepted golang-github-lucas-clemente-quic-go 0.55.0-1 (source) into unstable (Eric Dorland)
[2025-09-26] Accepted golang-github-lucas-clemente-quic-go 0.54.1-1 (source all) into unstable (Eric Dorland)
[2025-08-29] Accepted golang-github-lucas-clemente-quic-go 0.54.0-3 (source) into unstable (Eric Dorland)
[2025-08-28] Accepted golang-github-lucas-clemente-quic-go 0.54.0-2 (source) into unstable (Eric Dorland)
[2025-08-20] Accepted golang-github-lucas-clemente-quic-go 0.54.0-1 (source) into unstable (Eric Dorland)
[2025-05-06] golang-github-lucas-clemente-quic-go 0.50.1-2 MIGRATED to testing (Debian testing watch)
[2025-04-25] Accepted golang-github-lucas-clemente-quic-go 0.50.1-2 (source) into unstable (John Goerzen)
[2025-04-05] golang-github-lucas-clemente-quic-go 0.50.1-1 MIGRATED to testing (Debian testing watch)
[2025-03-31] Accepted golang-github-lucas-clemente-quic-go 0.50.1-1 (source) into unstable (Jérémy Lal)
[2025-03-23] golang-github-lucas-clemente-quic-go 0.50.0-1 MIGRATED to testing (Debian testing watch)
[2025-03-18] Accepted golang-github-lucas-clemente-quic-go 0.50.0-1 (source) into unstable (Jérémy Lal)
[2024-09-08] Accepted golang-github-lucas-clemente-quic-go 0.46.0-2~bpo12+1 (source) into stable-backports (John Goerzen)
[2024-08-22] golang-github-lucas-clemente-quic-go 0.46.0-2 MIGRATED to testing (Debian testing watch)
[2024-08-14] Accepted golang-github-lucas-clemente-quic-go 0.46.0-2 (source) into unstable (Shengjing Zhu)
[2024-08-13] Accepted golang-github-lucas-clemente-quic-go 0.46.0-1 (source) into unstable (Shengjing Zhu)
[2024-05-19] golang-github-lucas-clemente-quic-go 0.38.2-2 MIGRATED to testing (Debian testing watch)
[2024-05-19] golang-github-lucas-clemente-quic-go 0.38.2-2 MIGRATED to testing (Debian testing watch)
[2024-05-14] Accepted golang-github-lucas-clemente-quic-go 0.38.2-2 (source) into unstable (Shengjing Zhu)
[2024-01-09] golang-github-lucas-clemente-quic-go 0.38.2-1 MIGRATED to testing (Debian testing watch)
[2024-01-04] Accepted golang-github-lucas-clemente-quic-go 0.38.2-1 (source) into unstable (Shengjing Zhu)
[2023-11-12] Accepted golang-github-lucas-clemente-quic-go 0.37.4-1~bpo12+1 (source all) into stable-backports (Debian FTP Masters) (signed by: John Goerzen)
[2023-08-21] golang-github-lucas-clemente-quic-go 0.37.4-1 MIGRATED to testing (Debian testing watch)
[2023-08-16] Accepted golang-github-lucas-clemente-quic-go 0.37.4-1 (source) into unstable (Shengjing Zhu)
[2023-07-27] Accepted golang-github-lucas-clemente-quic-go 0.37.0-1 (source) into experimental (Shengjing Zhu)

bugs [bug history graph]

all: 4
RC: 0
I&N: 4
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, exp, reproducibility
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 0.59.0-2