Executive brief
ngtcp2 is a software library used to implement the QUIC network protocol, which helps speed up internet communications. A security flaw exists where the library fails to properly check the size of incoming data when logging connection details. An attacker could send specially crafted network traffic to crash the application or potentially gain unauthorized control over the system.
Technical details
A stack-based buffer overflow (CWE-121) exists in the ngtcp2_qlog_parameters_set_transport_params() function within lib/ngtcp2_qlog.c. The vulnerability occurs when the library serializes peer-provided transport parameters into a fixed 1024-byte stack buffer (buf) during the QUIC handshake. Because there are no bounds checks when appending peer-influenced fields like Connection IDs or stateless reset tokens, a remote attacker can provide sufficiently large parameters to overflow the buffer. This requires the qlog callback to be enabled (qlog->write != NULL). The issue is fixed in version 1.22.1 by increasing the buffer size and improving safety; a temporary workaround is to disable qlog on the client side.
Affected products
- ngtcp2 ngtcp2 < 1.22.1
Timeline
- 2026-04-16: advisory: GitHub Security Advisory GHSA-f523-465f-8c8f published
- 2026-04-16: disclosed: CVE-2026-40170 published
- 2026-04-16: patched: Fix committed in version 1.22.1