CVE-2025-61684

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-61684", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-29T20:25:16.182Z", "datePublished": "2026-01-19T15:18:11.398Z", "dateUpdated": "2026-01-20T15:49:59.004Z"}, "containers": {"cna": {"title": "Quicly has assertion failures", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/h2o/quicly/security/advisories/GHSA-wr3c-345m-43v9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/h2o/quicly/security/advisories/GHSA-wr3c-345m-43v9"}, {"name": "https://github.com/h2o/quicly/commit/d9d3df6a8530a102b57d840e39b0311ce5c9e14e", "tags": ["x_refsource_MISC"], "url": "https://github.com/h2o/quicly/commit/d9d3df6a8530a102b57d840e39b0311ce5c9e14e"}], "affected": [{"vendor": "h2o", "product": "quicly", "versions": [{"version": "< d9d3df6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T15:18:11.398Z"}, "descriptions": [{"lang": "en", "value": "Quicly, an IETF QUIC protocol implementation, is susceptible to a denial-of-service attack prior to commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e. A remote attacker can exploit these bugs to trigger an assertion failure that crashes process using Quicly. Commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e fixes the issue."}], "source": {"advisory": "GHSA-wr3c-345m-43v9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T15:49:39.447750Z", "id": "CVE-2025-61684", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T15:49:59.004Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-61684", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T15:49:39.447750Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T15:49:45.335Z"}}], "cna": {"title": "Quicly has assertion failures", "source": {"advisory": "GHSA-wr3c-345m-43v9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "h2o", "product": "quicly", "versions": [{"status": "affected", "version": "< d9d3df6"}]}], "references": [{"url": "https://github.com/h2o/quicly/security/advisories/GHSA-wr3c-345m-43v9", "name": "https://github.com/h2o/quicly/security/advisories/GHSA-wr3c-345m-43v9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/h2o/quicly/commit/d9d3df6a8530a102b57d840e39b0311ce5c9e14e", "name": "https://github.com/h2o/quicly/commit/d9d3df6a8530a102b57d840e39b0311ce5c9e14e", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Quicly, an IETF QUIC protocol implementation, is susceptible to a denial-of-service attack prior to commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e. A remote attacker can exploit these bugs to trigger an assertion failure that crashes process using Quicly. Commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T15:18:11.398Z"}}}, "cveMetadata": {"cveId": "CVE-2025-61684", "state": "PUBLISHED", "dateUpdated": "2026-01-20T15:49:59.004Z", "dateReserved": "2025-09-29T20:25:16.182Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-19T15:18:11.398Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "quicly", "vendor": "h2o", "versions": [{"status": "affected", "version": "< d9d3df6"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:h2o:quicly:*:*:*:*:*:*:*:*", "matchCriteriaId": "CCFF0DC7-599C-48E9-8F7F-10F75D383BE2", "versionEndExcluding": "2026-01-18", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Quicly, an IETF QUIC protocol implementation, is susceptible to a denial-of-service attack prior to commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e. A remote attacker can exploit these bugs to trigger an assertion failure that crashes process using Quicly. Commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e fixes the issue."}, {"lang": "es", "value": "Quicly, una implementaci\u00f3n del protocolo QUIC de IETF, es susceptible a un ataque de denegaci\u00f3n de servicio anterior al commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e. Un atacante remoto puede explotar estos errores para desencadenar un fallo de aserci\u00f3n que bloquea el proceso que usa Quicly. El commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e soluciona el problema."}], "id": "CVE-2025-61684", "lastModified": "2026-06-17T09:50:46.433", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61684", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T15:49:39.447750Z", "version": "2.0.3"}}]}, "published": "2026-01-19T16:15:53.423", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/h2o/quicly/commit/d9d3df6a8530a102b57d840e39b0311ce5c9e14e"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/h2o/quicly/security/advisories/GHSA-wr3c-345m-43v9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-617"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"created": "2026-01-20T08:43:28.640772+00:00", "updated": "2026-01-20T08:43:28.640800+00:00", "vendors": ["h20", "h20$PRODUCT$quickly"]}