A vulnerability in quic-go allows a misbehaving or malicious server to cause a denial-of-service (DoS) by triggering a client crash. This occurs when the server sends a premature HANDSHAKE_DONE frame during the handshake, violating protocol expectations and causing an assertion failure in the client. The issue affects multiple versions prior to 0.49.1 and between 0.50.0 and 0.54.0 inclusive. Fixed versions include 0.49.1, 0.54.1, and later releases. Users should upgrade to these fixed versions to prevent crashes.