CVE-2026-40170

ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client.

• CWE-121
• CWE-120

• https://github.com/ngtcp2/ngtcp2/commit/708a7640c1f48fb8ffb540c4b8ea5b4c1dfb8ee5Patch
• https://github.com/ngtcp2/ngtcp2/security/advisories/GHSA-f523-465f-8c8fExploit, Mitigation, Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/04/17/12Exploit, Mailing List, Mitigation, Patch, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:22963
• https://access.redhat.com/errata/RHSA-2026:25049
• https://access.redhat.com/errata/RHSA-2026:9113
• https://access.redhat.com/security/cve/CVE-2026-40170
• https://bugzilla.redhat.com/show_bug.cgi?id=2459061
• https://github.com/ngtcp2/ngtcp2/security/advisories/GHSA-f523-465f-8c8fExploit, Mitigation, Patch, Vendor Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40170.json

Published

Apr 16, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40164jq is a command-line JSON processor. Before commit 0c7d133c3…7.5
• CVE-2026-40165authentik is an open-source identity provider. Versions 2025…8.7
• CVE-2026-40166authentik is an open-source identity provider. In versions p…7.1
• CVE-2026-40168Postiz is an AI social media scheduling tool. Prior to 2.21.…8.2
• CVE-2026-40169ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-4017Buffer Overflow in the entry handler of the TraceEvent() sys…7.4
• CVE-2026-40171In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab…8.4
• CVE-2026-40172authentik is an open-source identity provider. In versions p…8.1
• CVE-2026-40173Dgraph is an open source distributed GraphQL database. Versi…9.4
• CVE-2026-40174Masa CMS is a content management system forked from Mura CMS…7.1
• CVE-2026-40175Axios is a promise based HTTP client for the browser and Nod…4.8
• CVE-2026-40176Composer is a dependency manager for PHP. Versions 1.0 throu…7.8