Skip to main content

ngtcp2 CVE-2026-40170

| EUVDEUVD-2026-23302 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-04-16 GitHub_M
Buffer Overflow Stack Overflow Ngtcp2
7.5
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Remote unauthenticated peer triggers the overflow with low complexity during handshake; qlog-enabled precondition sits on victim config not attacker, so PR:N/AC:L retained and impact scored conservatively as availability-only crash.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Source Code Evidence Fetched
Jul 24, 2026 - 07:17 vuln.today
Analysis Generated
Jul 24, 2026 - 07:17 vuln.today
Patch released
Apr 20, 2026 - 16:16 nvd
Patch available
Patch available
Apr 16, 2026 - 22:46 EUVD
EUVD ID Assigned
Apr 16, 2026 - 22:00 euvd
EUVD-2026-23302
CVE Published
Apr 16, 2026 - 21:34 nvd
HIGH 7.5

DescriptionCVE.org

ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client.

AnalysisAI

Stack buffer overflow in ngtcp2, a C implementation of the IETF QUIC protocol, affects all versions prior to 1.22.1 when the qlog logging callback is enabled. The function ngtcp2_qlog_parameters_set_transport_params() serializes peer-supplied QUIC transport parameters into a fixed 1024-byte stack buffer without bounds checking, so a remote peer can send oversized transport parameters during the handshake to write past the buffer and crash the process (availability impact per CVSS 7.5). SSVC lists exploitation status as 'poc' and there is publicly available exploit code exists, but EPSS is very low at 0.04% (12th percentile), and it is not in CISA KEV.

Technical ContextAI

ngtcp2 is a widely-embedded QUIC transport library (used underneath HTTP/3 stacks such as those built on nghttp3/curl) that exposes an optional qlog callback for standardized QUIC event logging. The root cause is CWE-121 (Stack-Based Buffer Overflow): during handshake, peer transport parameters are serialized into a fixed on-stack array uint8_t buf[1024] inside lib/ngtcp2_qlog.c with no length validation against the actual serialized size. Because QUIC transport parameters are attacker-controllable and can be large, the serialization overruns the stack frame. The affected component is only reached when the application registers a qlog callback and processes untrusted peer parameters, which is why the CPE (cpe:2.3:a:ngtcp2:ngtcp2:*) is qualified by a runtime configuration precondition rather than being universally exploitable.

RemediationAI

Vendor-released patch: upgrade to ngtcp2 1.22.1 or later, which addresses the overflow (fix commit 708a7640c1f48fb8ffb540c4b8ea5b4c1dfb8ee5). Red Hat users should apply the corresponding errata: RHSA-2026:9113, RHSA-2026:22963, or RHSA-2026:25049 as applicable to their release. If immediate upgrade is not possible, the vendor-recommended workaround is to disable the qlog callback on the client (do not register/enable qlog), which removes the vulnerable code path entirely; the trade-off is loss of QUIC event logging/observability used for debugging. Reference the upstream advisory at https://github.com/ngtcp2/ngtcp2/security/advisories/GHSA-f523-465f-8c8f and the oss-security disclosure at http://www.openwall.com/lists/oss-security/2026/04/17/12. Note: the public fix commit shown enlarges the stack buffer from 1024 to 2048 bytes; verify you are on the tagged 1.22.1 release rather than relying on buffer resizing alone, since a larger fixed buffer without full bounds checking may not eliminate all overflow conditions.

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 12 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Fixed

Share

CVE-2026-40170 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy