ngtcp2 up to 1.22.0 ngtcp2_qlog_parameters_set_transport_params stack-based overflow

Summaryinfo

A vulnerability classified as critical was found in ngtcp2 up to 1.22.0. The impacted element is the function ngtcp2_qlog_parameters_set_transport_params. Such manipulation leads to stack-based overflow. This vulnerability is referenced as CVE-2026-40170. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in ngtcp2 up to 1.22.0 and classified as critical. Affected by this issue is the function ngtcp2_qlog_parameters_set_transport_params. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. CVE summarizes:

ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-40170 since 04/09/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 307377 (Linux Distros Unpatched Vulnerability : CVE-2026-40170), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.22.1 eliminates this vulnerability. Applying the patch 708a7640c1f48fb8ffb540c4b8ea5b4c1dfb8ee5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (307377). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• ngtcp2

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22.0

License

• open-source

Website

• Product: https://github.com/ngtcp2/ngtcp2/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion