CVE-2026-40898

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40898", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-15T16:37:22.766Z", "datePublished": "2026-06-04T17:43:36.803Z", "dateUpdated": "2026-06-04T18:40:44.304Z"}, "containers": {"cna": {"title": "quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9"}, {"name": "https://github.com/quic-go/quic-go/releases/tag/v0.59.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/quic-go/quic-go/releases/tag/v0.59.1"}], "affected": [{"vendor": "quic-go", "product": "quic-go", "versions": [{"version": "< 0.59.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-04T17:43:36.803Z"}, "descriptions": [{"lang": "en", "value": "quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or large values. The implementation builds an `http.Header` for the corresponding `http.Request` or `http.Response`, while only enforcing limits on the size of the QPACK-compressed HEADERS frame, not on the decoded field section. This can lead to memory exhaustion. This is very similar to CVE-2025-64702. The difference is that this issue uses HTTP trailers, rather than HTTP headers, as the attack vector. A misbehaving or malicious peer can cause a denial-of-service (DoS) attack against quic-go's HTTP/3 servers or clients by triggering excessive memory allocation, potentially leading to crashes or resource exhaustion. This affects both servers and clients due to symmetric header construction. Version 0.59.1 enforces RFC 9114 decoded field section size limits for trailers as well. It incrementally decodes QPACK entries and checks the field section size after each entry, aborting the stream if an entry causes the limit to be exceeded."}], "source": {"advisory": "GHSA-vvgj-x9jq-8cj9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-04T18:40:25.619349Z", "id": "CVE-2026-40898", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T18:40:44.304Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40898", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T18:40:25.619349Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T18:40:33.584Z"}}], "cna": {"title": "quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion", "source": {"advisory": "GHSA-vvgj-x9jq-8cj9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "quic-go", "product": "quic-go", "versions": [{"status": "affected", "version": "< 0.59.1"}]}], "references": [{"url": "https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9", "name": "https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/quic-go/quic-go/releases/tag/v0.59.1", "name": "https://github.com/quic-go/quic-go/releases/tag/v0.59.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or large values. The implementation builds an `http.Header` for the corresponding `http.Request` or `http.Response`, while only enforcing limits on the size of the QPACK-compressed HEADERS frame, not on the decoded field section. This can lead to memory exhaustion. This is very similar to CVE-2025-64702. The difference is that this issue uses HTTP trailers, rather than HTTP headers, as the attack vector. A misbehaving or malicious peer can cause a denial-of-service (DoS) attack against quic-go's HTTP/3 servers or clients by triggering excessive memory allocation, potentially leading to crashes or resource exhaustion. This affects both servers and clients due to symmetric header construction. Version 0.59.1 enforces RFC 9114 decoded field section size limits for trailers as well. It incrementally decodes QPACK entries and checks the field section size after each entry, aborting the stream if an entry causes the limit to be exceeded."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-04T17:43:36.803Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40898", "state": "PUBLISHED", "dateUpdated": "2026-06-04T18:40:44.304Z", "dateReserved": "2026-04-15T16:37:22.766Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-04T17:43:36.803Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "quic-go", "vendor": "quic-go", "versions": [{"status": "affected", "version": "< 0.59.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:quic-go_project:quic-go:*:*:*:*:*:*:*:*", "matchCriteriaId": "24C2AA10-3C35-459E-9F17-9415D9ED7147", "versionEndExcluding": "0.59.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or large values. The implementation builds an `http.Header` for the corresponding `http.Request` or `http.Response`, while only enforcing limits on the size of the QPACK-compressed HEADERS frame, not on the decoded field section. This can lead to memory exhaustion. This is very similar to CVE-2025-64702. The difference is that this issue uses HTTP trailers, rather than HTTP headers, as the attack vector. A misbehaving or malicious peer can cause a denial-of-service (DoS) attack against quic-go's HTTP/3 servers or clients by triggering excessive memory allocation, potentially leading to crashes or resource exhaustion. This affects both servers and clients due to symmetric header construction. Version 0.59.1 enforces RFC 9114 decoded field section size limits for trailers as well. It incrementally decodes QPACK entries and checks the field section size after each entry, aborting the stream if an entry causes the limit to be exceeded."}, {"lang": "es", "value": "quic-go es una implementaci\u00f3n del protocolo QUIC en Go. Antes de la versi\u00f3n 0.59.1, un atacante puede causar una asignaci\u00f3n de memoria excesiva en las implementaciones de cliente y servidor HTTP/3 de quic-go al enviar una trama HEADERS codificada en QPACK que se decodifica en una secci\u00f3n de campo de tr\u00e1iler grande con muchos nombres de campo \u00fanicos y/o valores grandes. La implementaci\u00f3n construye un 'http.Header' para el 'http.Request' o 'http.Response' correspondiente, mientras que solo aplica l\u00edmites al tama\u00f1o de la trama HEADERS comprimida con QPACK, no a la secci\u00f3n de campo decodificada. Esto puede llevar al agotamiento de la memoria. Esto es muy similar a CVE-2025-64702. La diferencia es que este problema utiliza tr\u00e1ileres HTTP, en lugar de encabezados HTTP, como vector de ataque. Un par con comportamiento incorrecto o malicioso puede causar un ataque de denegaci\u00f3n de servicio (DoS) contra los servidores o clientes HTTP/3 de quic-go al desencadenar una asignaci\u00f3n de memoria excesiva, lo que podr\u00eda llevar a fallos o agotamiento de recursos. Esto afecta tanto a servidores como a clientes debido a la construcci\u00f3n sim\u00e9trica de encabezados. La versi\u00f3n 0.59.1 aplica los l\u00edmites de tama\u00f1o de la secci\u00f3n de campo decodificada de RFC 9114 tambi\u00e9n para los tr\u00e1ileres. Decodifica incrementalmente las entradas QPACK y verifica el tama\u00f1o de la secci\u00f3n de campo despu\u00e9s de cada entrada, abortando el flujo si una entrada hace que se exceda el l\u00edmite."}], "id": "CVE-2026-40898", "lastModified": "2026-07-22T20:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40898", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-04T18:40:25.619349Z", "version": "2.0.3"}}]}, "published": "2026-06-04T19:16:28.713", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/quic-go/quic-go/releases/tag/v0.59.1"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.59.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "quic-go", "source": "cna", "vendor": "quic-go"}, "product": "quic-go", "vendor": "quic-go"}], "created": "2026-06-04T19:30:21.818631+00:00", "updated": "2026-06-05T10:07:22.516484+00:00", "vendors": ["quic-go", "quic-go$PRODUCT$quic-go"]}