CVE-2026-40170

ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, the function ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without performing bounds checking. If qlog is enabled, a remote peer can send excessively large transport parameters during the QUIC handshake, leading to writes that exceed the buffer boundary and resulting in a stack buffer overflow. This vulnerability affects deployments that have the qlog callback enabled and process untrusted peer transport parameters. The issue has been addressed in version 1.22.1. If developers cannot upgrade immediately, they can disable the qlog on the client.

‍