SB20261109102 - Fedora EPEL 10.2 update for syncthing

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109102

SB20261109102 - Fedora EPEL 10.2 update for syncthing

Published: November 9, 2026

Security Bulletin ID SB20261109102
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Partial DoS

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-40898)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to cause denial of service through excessive memory allocation in quic-go HTTP/3 clients and servers.

The vulnerability exists due to missing decoded trailer field section size limits in the HTTP/3 implementation when processing QPACK-encoded HEADERS frames, despite limits on compressed frame size. An unauthenticated remote attacker can send crafted trailer frames that expand substantially during decoding and exhaust the receiving peer's memory.


Remediation

Install update from vendor's website.

References