Stack Buffer Overflow in ngtcp2 Implementation of IETF QUIC Protocol

CVE-2026-40170

What is CVE-2026-40170?

A stack buffer overflow vulnerability exists in ngtcp2, a C implementation of the IETF QUIC protocol, specifically in the function ngtcp2_qlog_parameters_set_transport_params(). This issue arises from the lack of bounds checking when serializing peer transport parameters into a fixed 1024-byte stack buffer. When the qlog is enabled, an untrusted remote peer can exploit this vulnerability by sending overly large transport parameters during the QUIC handshake. This can lead to unauthorized memory writes beyond the designated buffer boundary. To mitigate this risk, it is recommended to upgrade to ngtcp2 version 1.22.1 or disable the qlog callback on clients until an upgrade can be performed.

References