CVE-2026-40170 Details

A stack-based buffer overflow vulnerability has been identified in ngtcp2, a C implementation of the IETF QUIC protocol, in versions prior to 1.22.1. The issue arises in the function ngtcp2_qlog_parameters_set_transport_params(), which serializes peer transport parameters into a fixed 1024-byte stack buffer without proper bounds checking. When qlog is enabled, a remote peer can send oversized transport parameters during the QUIC handshake, leading to out-of-bounds writes and a stack buffer overflow. This vulnerability affects deployments that process untrusted peer transport parameters with qlog enabled.

Users can upgrade to ngtcp2 version 1.22.1, which addresses the vulnerability by increasing the buffer size to 2048 bytes and implementing proper bounds checks. If an immediate upgrade is not possible, qlog can be disabled on the client.