CVE-2026-40170 ngtcp2 has a qlog transport parameter serialization stack buffer overflow

ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2qlogparameterssettransportparams serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport...

PT-2026-33369

Name of the Vulnerable Software and Affected Versions ngtcp2 versions prior to 1.22.1 Description The ngtcp2 qlog parameters set transport params function serializes peer transport parameters into a fixed 1024-byte stack buffer without performing bounds checking. When qlog is enabled, a remote pe...

ngtcp2 安全漏洞

ngtcp2 is an open-source library developed by ngtcp2. Versions of ngtcp2 prior to 1.22.1 contained security vulnerabilities. These vulnerabilities stemmed from the fact that when qlog was enabled, the ngtcp2qlogparameterssettransportparams function serialized transport parameters into a fixed-siz...

TencentOS Server 4: nodejs (TSSA-2025:0324)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0324 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

EUVD-2024-46056

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2024-52811

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a...

SUSE CVE-2024-52811

The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a buffer overflow. In ngtcp2conn::connrecvpkt for an ACK, there was new logic that got added to skip connrecvack if an ack has already been...

CVE-2024-52811

A flaw was found in the ngtcp2 project. In affected versions, acks are not validated before being written to the qlog, leading to a buffer overflow...

CVE-2024-52811

The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a buffer overflow. In ngtcp2conn::connrecvpkt for an ACK, there was new logic that got added to skip connrecvack if an ack has already been...

CVE-2024-52811 Acks not validated before logged to qlog leads to buffer overflow in ngtcp2

The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a buffer overflow. In ngtcp2conn::connrecvpkt for an ACK, there was new logic that got added to skip connrecvack if an ack has already been...

CVE-2024-52811 Acks not validated before logged to qlog leads to buffer overflow in ngtcp2

The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a buffer overflow. In ngtcp2conn::connrecvpkt for an ACK, there was new logic that got added to skip connrecvack if an ack has already been...

CVE-2024-52811

CVE-2024-52811 affects ngtcp2 (QUIC in C). A patch added in conn_recv_pkt skips ngtcp2_pkt_validate_ack for certain acks, allowing an invalid ack to reach qlog, where ngtcp2_qlog::write_ack_frame can underflow when largest_ack=0 and first_ack_range=15, overwriting a heap buffer and causing heap o...

CVE-2024-52811

The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a buffer overflow. In ngtcp2conn::connrecvpkt for an ACK, there was new logic that got added to skip connrecvack if an ack has already been...

CVE-2024-52811 Acks not validated before logged to qlog leads to buffer overflow in ngtcp2

The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a buffer overflow. In ngtcp2conn::connrecvpkt for an ACK, there was new logic that got added to skip connrecvack if an ack has already been...

ngtcp2 安全漏洞

ngtcp2 is an open source library for ngtcp2. A security vulnerability exists in ngtcp2 that stems from a buffer overflow caused by ack not being validated before writing to the qlog...

PT-2024-35460 · Ngtcp2 · Ngtcp2

Name of the Vulnerable Software and Affected Versions: ngtcp2 versions prior to 1.9.1 Description: The issue arises from the lack of validation of acks before they are written to the qlog, leading to a buffer overflow. This occurs in the ngtcp2 conn::conn recv pkt function when handling an ACK,...

QLOG - Windows Security Logging

QLOG provides enriched Event Logging for security related events on Windows based systems. It is under heavy development and currently in alpha state. QLOG doesn’t use API hooks and it doesn’t require a driver to be installed on the target system, QLOG only uses ETW to retrieve its telemetry...