CVE-2026-129135

picoquic before 2026.11.05.3e2e3d3 Integer Overflow via TIME_STAMP Frame Decoder

Published Nov 13, 2026 CVSS 4.0 · 6.3 Medium EPSS n/a KEV · Not listed

Description

picoquic before 2026.11.05.3e2e3d3 contains an integer overflow vulnerability in picoquic_decode_time_stamp_frame() that allows remote QUIC peers to corrupt stored timestamps by sending oversized TIME_STAMP values. Attackers on connections negotiating the TIME_STAMP extension can send large values shifted by ack_delay_exponent to wrap the result, corrupting RTT and bandwidth estimation and degrading congestion control.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

private-octopus

picoquic

unaffected

Version	Status	Constraints
`0`	affected	< 2026.11.05.3e2e3d3

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/private-octopus/picoquic
https://github.com/private-octopus/picoquic/blob/7966b3f6a5f1dc08a844b3bfa0b22b0f8d424736/picoquic/frames.c#L5651
https://github.com/private-octopus/picoquic/commit/ef21278928771a1ace1c6764cf0e5300d61f7d94
https://github.com/private-octopus/picoquic/issues/2365
https://github.com/private-octopus/picoquic/pull/2343
https://github.com/private-octopus/picoquic/releases/tag/v2026.11.05.3e2e3d3
https://www.vulncheck.com/advisories/picoquic-before-2026.11.05-3e2e3d3-integer-overflow-via-time-stamp-frame-decoder

History

Nov 13, 2026 4:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		picoquic before 2026.11.05.3e2e3d3 contains an integer overflow vulnerability in picoquic_decode_time_stamp_frame() that allows remote QUIC peers to corrupt stored timestamps by sending oversized TIME_STAMP values. Attackers on connections negotiating the TIME_STAMP extension can send large values shifted by ack_delay_exponent to wrap the result, corrupting RTT and bandwidth estimation and degrading congestion control.
Title		picoquic before 2026.11.05.3e2e3d3 Integer Overflow via TIME_STAMP Frame Decoder
First Time appeared		Privateoctopus Privateoctopus picoquic
Weaknesses		CWE-190
CPEs		cpe:2.3:a:privateoctopus:picoquic::::::::
Vendors & Products		Privateoctopus Privateoctopus picoquic
References		https://github.com/private-octopus/picoquic https://github.com/private-octopus/picoquic/blob/7966b3f6a5f1dc08a844b3bfa0b22b0f8d424736/picoquic/frames.c#L5651 https://github.com/private-octopus/picoquic/commit/ef21278928771a1ace1c6764cf0e5300d61f7d94 https://github.com/private-octopus/picoquic/issues/2365 https://github.com/private-octopus/picoquic/pull/2343 https://github.com/private-octopus/picoquic/releases/tag/v2026.11.05.3e2e3d3 https://www.vulncheck.com/advisories/picoquic-before-2026.11.05-3e2e3d3-integer-overflow-via-time-stamp-frame-decoder
Metrics		cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`