Skip to content
OpenAdvisories

Vendor

ngtcp2

2 known vulnerabilities.

Products

ngtcp2 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-40170

    ngtcp2 has a qlog transport parameter serialization stack buffer overflow

    ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote…

    ngtcp2 ngtcp2 ngtcp2 ngtcp2 Debian Ubuntu Alpine
  • High 8.2
    CVE-2024-52811

    Acks not validated before logged to qlog leads to buffer overflow in ngtcp2

    The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a buffer overflow. In `ngtcp2_conn::conn_recv_pkt` for an ACK, there was new logic that got added to …

    ngtcp2 ngtcp2 ngtcp2 Ubuntu