LiveActive security incident?Get immediate response
CVE Record

CVE-2026-40170: ngtcp2 has a qlog transport parameter serialization stack buffer overflow

ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2026-40170 can let an unauthenticated remote peer crash affected ngtcp2-based QUIC software when qlog logging is enabled. The issue is fixed in ngtcp2 1.22.1. The primary business risk is service disruption, not confirmed data theft or code execution based on the supplied sources.

Executive priority

Treat this as a high-priority availability risk for QUIC-enabled systems using ngtcp2 with qlog enabled. Patch or disable qlog promptly, especially on externally reachable services. No supplied source confirms active exploitation, so urgency should be driven by exposure and service criticality.

Technical view

Before 1.22.1, ngtcp2_qlog_parameters_set_transport_params() writes peer QUIC transport parameters into a fixed 1024-byte stack buffer without bounds checks. With qlog enabled, oversized peer transport parameters during handshake can trigger a stack buffer overflow. CVSS 3.1 is 7.5, network-reachable, unauthenticated, availability impact high.

Likely exposure

Exposure is likely limited to products or services using ngtcp2 versions earlier than 1.22.1 with qlog callbacks enabled while accepting untrusted QUIC peers. Red Hat advisories indicate downstream packaging attention, but the supplied bundle does not enumerate every affected distribution or application.

Exploitation context

The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The described attack surface is remote QUIC handshake processing when qlog is enabled. The documented impact is a stack buffer overflow causing availability loss; do not assume broader impact without vendor evidence.

Researcher notes

The key condition is qlog-enabled serialization of untrusted peer transport parameters. The fixed commit should be reviewed to confirm bounds-safe serialization behavior. Evidence supports CWE-120 and CWE-121 classification, but the bundle does not provide proof of exploitation in the wild.

Mitigation direction

  • Upgrade ngtcp2 to version 1.22.1 or later.
  • If immediate upgrade is not possible, disable qlog on client as vendor guidance states.
  • Review Red Hat advisories for applicable downstream package updates.
  • Prioritize internet-facing QUIC services that enable qlog or diagnostic callbacks.

Validation and detection

  • Inventory applications and packages that embed or link ngtcp2.
  • Confirm deployed ngtcp2 versions are 1.22.1 or later.
  • Check whether qlog callbacks are enabled in affected services.
  • Verify applicable Red Hat errata are installed where Red Hat packages are used.
  • Review service logs for crash patterns during QUIC handshakes.
Prepared
Confidence
high
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-120: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · low confidence lookup

CWE-121: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-40170 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
5Timeline events
3ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: yesTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6GitHub_M
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6redhat-SADP

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2026-40170Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. ADP timelineredhat-SADP

    Made public.

  3. CVE publishedCVE Program

    The CVE record was published.

  4. ADP timelineredhat-SADP

    Reported to Red Hat.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc
redhat-SADPngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake
other:Red Hat severity ratingcvssV3_1
  • 2026-04-16T22:00:56.443Z: Reported to Red Hat.
  • 2026-04-16T21:34:07.610Z: Made public.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
ngtcp2ngtcp2< 1.22.1Listed
Weakness

CWE details

CWE-120CWE-121

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-120 · source CWE mapping

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs
CWE-121 · source CWE mapping

Stack-based Buffer Overflow

Stack-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs