PT-2026-48517

Unbounded memory allocation in the CRYPTO frame reassembler in s2n-quic before 1.8.2 may allow an unauthenticated remote actor to cause a denial of service degraded availability by sending crafted QUIC Initial packets. To remediate this issue, users should upgrade to v1.8.2...

Debian dsa-6222 : libngtcp2-16 - security update

The remote Debian 12 / 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6222 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6222-1 [email protected] https://www.debian.org/security/...

CVE-2026-40170

ngtcp2 (QUIC) vulnerability: in versions before 1.22.1, ngtcp2_qlog_parameters_set_transport_params() writes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking, enabling a stack buffer overflow when qlog is enabled and large untrusted parameters are received dur...

Integer Underflow (Wrap or Wraparound)

Overview Affected versions of this package are vulnerable to Integer Underflow Wrap or Wraparound in the ACK frame decoding. An attacker can gain elevated privileges by sending specially crafted network packets that trigger an integer underflow during frame parsing. Remediation Upgrade...

GO-2025-4233 HTTP/3 QPACK Header Expansion DoS in github.com/quic-go/quic-go

HTTP/3 QPACK Header Expansion DoS in github.com/quic-go/quic-go...

CVE-2025-54939

CVE-2025-54939 affects the LiteSpeed QUIC (LSQUIC) Library prior to 4.3.1, where a memory leak in the lsquic_engine_packet_in path can cause linear memory growth and potential DoS. The vulnerability is triggered by mis-handling coalesced QUIC Initial packets before a handshake, leading to memory ...

CVE-2025-54939

LiteSpeed QUIC LSQUIC Library before 4.3.1 has an lsquicenginepacketin memory leak...

CVE-2024-25678

In LiteSpeed QUIC LSQUIC Library before 4.0.4, DCID validation is mishandled...

CVE-2024-25678

In LiteSpeed QUIC LSQUIC Library before 4.0.4, DCID validation is mishandled...

PT-2024-21086 · Litespeed · Lsquic

Name of the Vulnerable Software and Affected Versions: LiteSpeed QUIC LSQUIC Library versions prior to 4.0.4 Description: The issue is related to mishandled DCID validation. Recommendations: For versions prior to 4.0.4, update to version 4.0.4 or later to resolve the issue...

CVE-2023-36435

Microsoft QUIC Denial of Service Vulnerability...

CVE-2022-30592

liblsquic/lsquicqenchdl.c in LiteSpeed QUIC aka LSQUIC before 3.1.0 mishandles MAXTABLECAPACITY...