Description
ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ngtcp2 | ngtcp2 | < 1.22.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ngtcp2 | 1.22.1-1 | — |
| Debian 13 | ngtcp2 | 1.11.0-1+deb13u1 | — |
| Debian 12 | ngtcp2 | 0.12.1+dfsg-1+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | ngtcp2 | 1.16.0-1ubuntu0.1 | — |
| Ubuntu 25.10 | ngtcp2 | 1.11.0-1+deb13u1build0.25.10.1 | — |
| Ubuntu 24.04 LTS | ngtcp2 | 0.12.1+dfsg-1+deb12u1build0.24.04.1 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | ngtcp2 | 0.1.0+dfsg-1ubuntu0.1~esm1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | samba +36 | 4.23.5-109.el10_2 | RHSA-2026:22963 |
| RHEL 9 | ctdb +37 | 4.23.5-10.el9_8 | RHSA-2026:25049 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | ngtcp2 +6 | 1.22.1-1.hum1 | RHSA-2026:9113 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | samba +36 | 4.23.5-109.el10_2 | ALSA-2026:22963 |
| AlmaLinux 9 | samba +36 | 4.23.5-10.el9_8 | ALSA-2026:25049 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | samba | 4.23.5-109.el10_2 | RLSA-2026:22963 |
| Rocky Linux 9 | samba | 4.23.5-10.el9_8 | RLSA-2026:25049 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | nodejs22 | 22.23.0-150700.3.12.1 | SUSE-SU-2026:2695-1 |
| SLES 15 SP7 | nodejs24 | 24.17.0-150700.15.11.1 | SUSE-SU-2026:2633-1 |
| SLES 15 SP6 | nodejs20 | 20.20.2-150600.3.21.1 | SUSE-SU-2026:3929-1 |
| SLES 15 SP6 | nodejs22 | 22.23.0-150600.13.18.1 | SUSE-SU-2026:2647-1 |
| SLES 15 SP5 | nodejs20 | 20.20.2-150500.11.30.1 | SUSE-SU-2026:3930-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | nodejs22 | 22.23.0-160000.1.1 | SUSE-SU-2026:22368-1 |
| SLES for SAP 16.0 | nodejs24 | 24.18.0-160000.1.1 | SUSE-SU-2026:22565-1 |
| SLES for SAP 15 SP6 | nodejs20 | 20.20.2-150600.3.21.1 | SUSE-SU-2026:3929-1 |
| SLES for SAP 15 SP6 | nodejs22 | 22.23.0-150600.13.18.1 | SUSE-SU-2026:2647-1 |
| SLES for SAP 15 SP5 | nodejs20 | 20.20.2-150500.11.30.1 | SUSE-SU-2026:3930-1 |
| SLES 16.0 | nodejs22 | 22.23.0-160000.1.1 | SUSE-SU-2026:22368-1 |
| SLES 16.0 | nodejs24 | 24.18.0-160000.1.1 | SUSE-SU-2026:22565-1 |
| SLE HPC 15 SP5 | nodejs20 | 20.20.2-150500.11.30.1 | SUSE-SU-2026:3930-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ngtcp2 | 1.22.1-1.1 | openSUSE-SU-2026:10621-1 |
| openSUSE Tumbleweed | nodejs24 | 24.17.0-1.1 | openSUSE-SU-2026:11121-1 |
| openSUSE Tumbleweed | samba | 4.23.8+git.477.f78166bceed-1.1 | openSUSE-SU-2026:10884-1 |
| openSUSE Leap 16.0 | nodejs22 | 22.23.0-160000.1.1 | openSUSE-SU-2026:21058-1 |
| openSUSE Leap 16.0 | nodejs24 | 24.18.0-160000.1.1 | openSUSE-SU-2026:21236-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | ngtcp2 | 1.22.1-r0 | — |
| Alpine v3.23 | ngtcp2 | 1.22.1-r0 | — |
| Alpine v3.22 | ngtcp2 | 1.12.0-r1 | — |
| Alpine v3.21 | ngtcp2 | 1.9.1-r1 | — |
| Alpine v3.20 | ngtcp2 | 1.5.0-r1 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ngtcp2 +6 | 1.21.0-1.amzn2023.0.2 | ALAS2023-2026-1633 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | samba +36 | 4.23.5-109.el10_2 | ELSA-2026-22963 |
| Oracle Linux 9 | samba +36 | 4.23.5-10.el9_8 | ELSA-2026-25049 |
Advisories 23
- ALSA-2026:25049 Critical: samba security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:22963 Critical: samba security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:25049 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:22963 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:9113 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- SUSE-SU-2026:3929-1 Security update for nodejs20 SUSE / openSUSE Security Updates · Sep 10, 2026
- SUSE-SU-2026:3930-1 Security update for nodejs20 SUSE / openSUSE Security Updates · Sep 10, 2026
- WID-SEC-2026-1508 Samba: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jul 16, 2026
- ELSA-2026-22963 Critical: samba security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
- SUSE-SU-2026:22565-1 Security update for nodejs24 SUSE / openSUSE Security Updates · Jul 15, 2026
- openSUSE-SU-2026:21236-1 Security update for nodejs24 SUSE / openSUSE Security Updates · Jul 9, 2026
- SUSE-SU-2026:22368-1 Security update for nodejs22 SUSE / openSUSE Security Updates · Jul 2, 2026
- SUSE-SU-2026:2695-1 Security update for nodejs22 SUSE / openSUSE Security Updates · Jul 1, 2026
- openSUSE-SU-2026:21058-1 Security update for nodejs22 SUSE / openSUSE Security Updates · Jun 30, 2026
- SUSE-SU-2026:2647-1 Security update for nodejs22 SUSE / openSUSE Security Updates · Jun 27, 2026
- openSUSE-SU-2026:11121-1 corepack24-24.17.0-1.1 on GA media SUSE / openSUSE Security Updates · Jun 26, 2026
- SUSE-SU-2026:2633-1 Security update for nodejs24 SUSE / openSUSE Security Updates · Jun 26, 2026
- ELSA-2026-25049 Critical: samba security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 23, 2026
- RLSA-2026:25049 Critical: samba security update Rocky Linux Security Advisories · Jun 13, 2026
- RLSA-2026:22963 Critical: samba security update Rocky Linux Security Advisories · Jun 11, 2026
- openSUSE-SU-2026:10884-1 ctdb-4.23.8+git.477.f78166bceed-1.1 on GA media SUSE / openSUSE Security Updates · May 29, 2026
- ALAS2023-2026-1633 Important: ngtcp2 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 30, 2026
- openSUSE-SU-2026:10621-1 libngtcp2-16-1.22.1-1.1 on GA media SUSE / openSUSE Security Updates · Apr 27, 2026