PT-2026-46115 · Quic-Go · Quic-Go

Marten-Seemann · CVE-2026-40898 · Published 2026-06-03 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions quic-go (affected versions not specified)

Description An attacker can trigger excessive memory allocation in the HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame. This frame decodes into a large trailer field section containing numerous unique field names or large values. The system constructs an http.Header for the http.Request or http.Response but only enforces limits on the size of the compressed HEADERS frame rather than the decoded field section. This discrepancy allows a maliciously crafted frame to expand up to 50 times its encoded size using QPACK static table entries, leading to memory exhaustion and a denial-of-service (DoS) state.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-40898

GHSA-VVGJ-X9JQ-8CJ9

GO-2026-5676

OPENSUSE-SU-2026:21483-1

RHSA-2026:15862

RHSA-2026:25238

RHSA-2026:40223

Affected Products

Quic-Go

References · 1758

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40898.json · Exploit
• https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40898 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40898 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5676 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40898 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40898 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-40898 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-40898 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vvgj-x9jq-8cj9 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40898 · Vendor Advisory
• https://github.com/quic-go/quic-go/releases/tag/v0.59.1 · Note
• https://github.com/quic-go/quic-go/commit/c56e8c79d1627cc1ed6005b421b4b0adadd83665 · Note
• https://github.com/quic-go/quic-go/pull/5642 · Note