Memory exhaustion via QPACK trailer expansion in quic-go HTTP/3 (CVE-2026-40898)

quic-go's HTTP/3 client and server implementations enforce size limits on the QPACK-compressed HEADERS frame but not on the decoded trailer field section, allowing a malicious peer to send a crafted HEADERS frame that expands up to approximately 50 times its encoded size. This triggers excessive memory allocation, potentially causing crashes or resource exhaustion in both HTTP/3 servers and clients. Affected versions: - <= v0.59.0 We recommend updating to: v0.59.1. CVSS 7.5 · our assessment: this_week Reference: https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9 Details: https://vuln.today/cve/CVE-2026-40898