Allocation of Resources Without Limits or Throttling in quic-go - CVE-2026-40898

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU162771

Allocation of Resources Without Limits or Throttling in quic-go - CVE-2026-40898

Published: November 9, 2026


Vulnerability identifier: #VU162771
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40898
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows an unauthenticated remote attacker to cause denial of service through excessive memory allocation in quic-go HTTP/3 clients and servers.

The vulnerability exists due to missing decoded trailer field section size limits in the HTTP/3 implementation when processing QPACK-encoded HEADERS frames, despite limits on compressed frame size. An unauthenticated remote attacker can send crafted trailer frames that expand substantially during decoding and exhaust the receiving peer's memory.


Affected software

quic-go
Fedora
syncthing
prometheus

How to mitigate CVE-2026-40898

Install security update from vendor's website.

quic-go - update to 0.59.1
syncthing - addressed in versions 2.1.3-1.el10_2, 2.1.3-1.el10_3, 2.1.3-1.el10_4, 2.1.3-1.fc44, 2.1.3-1.fc45
prometheus - addressed in versions 3.13.1-1.fc43, 3.13.1-1.fc44

External References

Related Security Bulletins