PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40170 ngtcp2 CVE debrief

CVE-2026-40170 is a high-severity stack buffer overflow in ngtcp2’s qlog transport-parameter serialization path. When qlog is enabled, a remote peer can send sufficiently large QUIC transport parameters during the handshake and trigger writes beyond a fixed 1024-byte stack buffer. The issue is fixed in ngtcp2 1.22.1, and the vendor advises disabling qlog on clients if immediate upgrading is not possible.

Vendor
ngtcp2
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-16
Original CVE updated
2026-05-21
Advisory published
2026-04-16
Advisory updated
2026-05-21

Who should care

Teams running ngtcp2 in QUIC deployments, especially any environment that enables qlog and processes peer-supplied transport parameters during handshakes. Client-side integrations are specifically called out for interim mitigation.

Technical summary

ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. In versions prior to 1.22.1, an untrusted peer can supply oversized transport parameters during the QUIC handshake and cause a stack buffer overflow when qlog is enabled. The issue is mapped to CWE-121 and has CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Defensive priority

High priority for any exposed deployment with qlog enabled. Upgrade to a fixed release promptly, and treat client-side qlog disablement as the immediate risk-reduction step if upgrading is delayed.

Recommended defensive actions

  • Upgrade ngtcp2 to version 1.22.1 or later as soon as possible.
  • If you cannot upgrade immediately, disable qlog on clients per the vendor guidance.
  • Inventory deployments to confirm where qlog is enabled and where untrusted peer transport parameters are processed.
  • Validate that all embedded or bundled ngtcp2 copies are also updated, not just system packages.
  • Re-test QUIC handshake paths after patching to confirm qlog behavior is still aligned with operational requirements.

Evidence notes

CVE publishedAt is 2026-04-16T22:16:38.220Z, with a later NVD modification on 2026-05-21T19:35:19.783Z. The supplied NVD record lists CVSS 3.1 as AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and notes CWE-121. The referenced GitHub advisory and commit indicate the fix landed in ngtcp2 1.22.1, and the advisory text includes the client-side qlog disablement mitigation.

Official resources

Publicly disclosed on 2026-04-16. NVD metadata in the supplied corpus was last modified on 2026-05-21 and was still marked "Undergoing Analysis" at that time.