ngtcp2 has a qlog transport parameter serialization stack buffer overflow

The core of the vulnerability lies in the ngtcp2qlogparameterssettransport_params() function, which handles the serialization of peer transport parameters. Critically, it writes these parameters into a fixed-size 1024-byte stack buffer without performing any bounds checking. An attacker can exploit this by crafting a QUIC handshake containing excessively large transport parameters. When the qlog callback is enabled, this oversized data will cause writes beyond the buffer's boundaries, resulting in a stack buffer overflow. Successful exploitation could lead to a denial of service by crashing the ngtcp2 process. While the description doesn't explicitly mention code execution, a stack overflow can, in certain circumstances, be leveraged to overwrite critical program data or even inject malicious code, expanding the potential impact. The severity is amplified in deployments where the qlog callback is enabled and the system processes untrusted peer transport parameters.

1. Reserviert2026-04-09
2. Veröffentlicht2026-04-16
3. Geändert2026-04-20
4. EPSS aktualisiert2026-04-24

The primary mitigation for CVE-2026-40170 is to upgrade to ngtcp2 version 1.22.1 or later, which includes the fix for this buffer overflow. If upgrading immediately is not feasible, consider disabling the qlog callback feature, as this is a prerequisite for the vulnerability to be triggered. Alternatively, implement input validation on the peer transport parameters received during the QUIC handshake to ensure they remain within acceptable size limits. WAF or proxy rules could be configured to filter out QUIC handshake messages with unusually large transport parameter sizes. Monitor system logs for any crashes or unexpected behavior related to the ngtcp2 process, which could indicate exploitation attempts.