UBUNTU-CVE-2026-40170

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-40170
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-40170.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-40170
Upstream
Downstream
Related
Published
2026-04-16T22:16:00Z
Modified
2026-06-30T18:18:00Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client.

References

Affected packages

Ubuntu:Pro:22.04:LTS / ngtcp2

Package

Name
ngtcp2
Purl
pkg:deb/ubuntu/ngtcp2?arch=source&distro=esm-apps%2Fjammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.1.0+dfsg-1ubuntu0.1~esm1

Affected versions

Other
0~20210905-1
0.*
0.1.0+dfsg-1

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "libngtcp2-0",
            "binary_version": "0.1.0+dfsg-1ubuntu0.1~esm1"
        },
        {
            "binary_name": "libngtcp2-crypto-gnutls0",
            "binary_version": "0.1.0+dfsg-1ubuntu0.1~esm1"
        },
        {
            "binary_name": "ngtcp2-client",
            "binary_version": "0.1.0+dfsg-1ubuntu0.1~esm1"
        },
        {
            "binary_name": "ngtcp2-server",
            "binary_version": "0.1.0+dfsg-1ubuntu0.1~esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-40170.json"

Ubuntu:24.04:LTS / ngtcp2

Package

Name
ngtcp2
Purl
pkg:deb/ubuntu/ngtcp2?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.12.1+dfsg-1+deb12u1build0.24.04.1

Affected versions

0.*
0.12.1+dfsg-1
0.12.1+dfsg-1build1
0.12.1+dfsg-1build2

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "libngtcp2-9",
            "binary_version": "0.12.1+dfsg-1+deb12u1build0.24.04.1"
        },
        {
            "binary_name": "libngtcp2-crypto-gnutls2",
            "binary_version": "0.12.1+dfsg-1+deb12u1build0.24.04.1"
        },
        {
            "binary_name": "ngtcp2-client",
            "binary_version": "0.12.1+dfsg-1+deb12u1build0.24.04.1"
        },
        {
            "binary_name": "ngtcp2-server",
            "binary_version": "0.12.1+dfsg-1+deb12u1build0.24.04.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-40170.json"

Ubuntu:25.10 / ngtcp2

Package

Name
ngtcp2
Purl
pkg:deb/ubuntu/ngtcp2?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.11.0-1+deb13u1build0.25.10.1

Affected versions

1.*
1.11.0-1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "libngtcp2-16",
            "binary_version": "1.11.0-1+deb13u1build0.25.10.1"
        },
        {
            "binary_name": "libngtcp2-crypto-gnutls8",
            "binary_version": "1.11.0-1+deb13u1build0.25.10.1"
        },
        {
            "binary_name": "ngtcp2-client",
            "binary_version": "1.11.0-1+deb13u1build0.25.10.1"
        },
        {
            "binary_name": "ngtcp2-server",
            "binary_version": "1.11.0-1+deb13u1build0.25.10.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-40170.json"

Ubuntu:26.04:LTS / ngtcp2

Package

Name
ngtcp2
Purl
pkg:deb/ubuntu/ngtcp2?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.16.0-1ubuntu0.1

Affected versions

1.*
1.11.0-1
1.16.0-1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "libngtcp2-16",
            "binary_version": "1.16.0-1ubuntu0.1"
        },
        {
            "binary_name": "libngtcp2-crypto-gnutls8",
            "binary_version": "1.16.0-1ubuntu0.1"
        },
        {
            "binary_name": "libngtcp2-crypto-ossl0",
            "binary_version": "1.16.0-1ubuntu0.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-40170.json"