Attacks trigger excessive memory allocation in quic-go by sending a QPACK-encoded HEADERS frame that expands into a large trailer field section with many unique names or large values. The implementation builds an http.Header for the request or response, enforcing only the compressed frame size limit, not the decoded field section size. The result is memory exhaustion, potentially leading to crashes or performance degradation. Both clients and servers are affected since trailer construction is symmetric.

The vulnerability exists in quic-go, the QUIC protocol implementation in Go, for versions prior to 0.59.1 in both HTTP/3 client and server code. Upgrading to version 0.59.1 or later applies RFC‑9114 limits on the decoded trailer field section, mitigating the issue.

The CVSS score of 5.3 indicates moderate severity; the EPSS score is unavailable, and the vulnerability is not listed in CISA KEV. Attackers can exploit the flaw over the network by sending a malicious QUIC stream containing a crafted HEADERS frame, which is inferred as the likely attack vector from the description. If successful, the attacker can cause a denial‑of‑service through resource exhaustion on the target host.