CVE-2026-129135

picoquic before 2026.11.05.3e2e3d3 contains an integer overflow vulnerability in picoquicdecodetimestampframe that allows remote QUIC peers to corrupt stored timestamps by sending oversized TIMESTAMP values. Attackers on connections negotiating the TIMESTAMP extension can send large values shifte...