UBUNTU-CVE-2026-40170

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-40170
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-40170.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2026-40170
Upstream
Published
2026-04-16T22:16:00Z
Modified
2026-05-20T16:12:58.549239151Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2qlogparameterssettransport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client.

References

Affected packages

Ubuntu:22.04:LTS / ngtcp2

Package

Name
ngtcp2
Purl
pkg:deb/ubuntu/ngtcp2?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

Other
0~20210905-1
0.*
0.1.0+dfsg-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libngtcp2-0",
            "binary_version": "0.1.0+dfsg-1"
        },
        {
            "binary_name": "libngtcp2-crypto-gnutls0",
            "binary_version": "0.1.0+dfsg-1"
        },
        {
            "binary_name": "ngtcp2-client",
            "binary_version": "0.1.0+dfsg-1"
        },
        {
            "binary_name": "ngtcp2-server",
            "binary_version": "0.1.0+dfsg-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-40170.json"

Ubuntu:24.04:LTS / ngtcp2

Package

Name
ngtcp2
Purl
pkg:deb/ubuntu/ngtcp2?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.12.1+dfsg-1
0.12.1+dfsg-1build1
0.12.1+dfsg-1build2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libngtcp2-9",
            "binary_version": "0.12.1+dfsg-1build2"
        },
        {
            "binary_name": "libngtcp2-crypto-gnutls2",
            "binary_version": "0.12.1+dfsg-1build2"
        },
        {
            "binary_name": "ngtcp2-client",
            "binary_version": "0.12.1+dfsg-1build2"
        },
        {
            "binary_name": "ngtcp2-server",
            "binary_version": "0.12.1+dfsg-1build2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-40170.json"

Ubuntu:25.10 / ngtcp2

Package

Name
ngtcp2
Purl
pkg:deb/ubuntu/ngtcp2?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.11.0-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libngtcp2-16",
            "binary_version": "1.11.0-1"
        },
        {
            "binary_name": "libngtcp2-crypto-gnutls8",
            "binary_version": "1.11.0-1"
        },
        {
            "binary_name": "ngtcp2-client",
            "binary_version": "1.11.0-1"
        },
        {
            "binary_name": "ngtcp2-server",
            "binary_version": "1.11.0-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-40170.json"

Ubuntu:26.04:LTS / ngtcp2

Package

Name
ngtcp2
Purl
pkg:deb/ubuntu/ngtcp2?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.11.0-1
1.16.0-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libngtcp2-16",
            "binary_version": "1.16.0-1"
        },
        {
            "binary_name": "libngtcp2-crypto-gnutls8",
            "binary_version": "1.16.0-1"
        },
        {
            "binary_name": "libngtcp2-crypto-ossl0",
            "binary_version": "1.16.0-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-40170.json"