CVE-2026-40170

ngtcp2 (QUIC) vulnerability: in versions before 1.22.1, ngtcp2_qlog_parameters_set_transport_params() writes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking, enabling a stack buffer overflow when qlog is enabled and large untrusted parameters are received dur...

CVE-2026-40170

ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2qlogparameterssettransportparams serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport...

CVE-2026-40170

ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2qlogparameterssettransportparams serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport...

Security update for rust1.93

This update for rust1.93 fixes the following issues: Security issue: CVE-2026-31812: denial of service via crafted QUIC initial packet bsc1259623. Non security issue: Resolve missing gcc requirement that may affect some crate buildin bsc1253321. Patch Instructions: To install this SUSE update use...

SUSE-SU-2026:1415-1 Security update for rust1.93

This update for rust1.93 fixes the following issues: Security issue: - CVE-2026-31812: denial of service via crafted QUIC initial packet bsc1259623. Non security issue: - Resolve missing gcc requirement that may affect some crate buildin bsc1253321...

Integer Underflow (Wrap or Wraparound)

Overview Affected versions of this package are vulnerable to Integer Underflow Wrap or Wraparound in the ACK frame decoding. An attacker can gain elevated privileges by sending specially crafted network packets that trigger an integer underflow during frame parsing. Remediation Upgrade...

GHSA-GVVW-8J96-8G5R MsQuic has a Remote Elevation of Privilege Vulnerability

Summary Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network. Details Improper Input Validation Integer Underflow Wrap or Wraparound when decoding ACK frame. Patches - Fix underflow in ACK frame parsing - 1e6e999b Impact An attacker who...

PT-2026-33284

A Critical Remote Elevation of Privilege vulnerability CVE-2026-32179 affects MsQuic. Organizations should identify usage and monitor for updates. MsQuic ElevationOfPrivilege infosec https://t.co/NfNpj6XuC3...

PT-2026-33369

Name of the Vulnerable Software and Affected Versions ngtcp2 versions prior to 1.22.1 Description The ngtcp2 qlog parameters set transport params function serializes peer transport parameters into a fixed 1024-byte stack buffer without performing bounds checking. When qlog is enabled, a remote pe...

Security update for rust1.92

This update for rust1.92 fixes the following issues: CVE-2026-31812: Denial of service via crafted QUIC initial packet bsc1259623. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the...

SUSE-SU-2026:1337-1 Security update for rust1.92

This update for rust1.92 fixes the following issues: - CVE-2026-31812: Denial of service via crafted QUIC initial packet bsc1259623...

CVE-2026-6328

Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux QUIC protocol implementation, packet processing module, STREAM frame handler modules allows Protocol Manipulation.This issue affects XQUIC: through 1.8.3...

CVE-2026-6328 XQUIC Improper STREAM Frame Validation in Initial/Handshake Packets

Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux QUIC protocol implementation, packet processing module, STREAM frame handler modules allows Protocol Manipulation.This issue affects XQUIC: through 1.8.3...

CVE-2026-6328 XQUIC Improper STREAM Frame Validation in Initial/Handshake Packets

Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux QUIC protocol implementation, packet processing module, STREAM frame handler modules allows Protocol Manipulation.This issue affects XQUIC: through 1.8.3...

XQUIC 安全漏洞

XQUIC is an open-source cross-platform implementation code base for QUIC and HTTP/3 protocols developed by Alibaba. Versions of XQUIC 1.8.3 and earlier contain security vulnerabilities. These vulnerabilities stem from improper input validation and encryption signature verification, which may lead...

April 14, 2026—KB5083768 (OS Build 28000.1836)

None None...

openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling

A flaw was found in openssl. A remote attacker could trigger a NULL pointer dereference by sending an unknown or unsupported cipher ID during the client hello callback in applications using the QUIC Quick UDP Internet Connections protocol. This vulnerability, occurring when the SSLCIPHERfind...

curl: Public key pinning bypass via QUIC and GnuTLS allows server impersonation

A flaw was found in curl. When configured to use public key pinning with QUIC connections and GnuTLS, and with standard certificate verification explicitly disabled, curl could bypass the intended public key check. This oversight allows a malicious server to impersonate a legitimate one,...

Security Bulletin: Memory Exhaustion Vulnerability in quic-go HTTP/3 Header Processing, affects watsonx.data

Summary quic-go versions 0.56.0 and below are vulnerable to memory exhaustion via specially crafted QPACK-encoded HEADERS frames. Insufficient limits on decoded header sizes allow attackers to trigger excessive memory allocation. This issue is fixed in version 0.57.0. This can affect watsonx.data...

SUSE CVE-2026-24030

An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service. In setups with a large quantity of memory available this usually results in an exception and the QUIC connection is properly...