CVE catalog

CVE-2026-40170

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Apr 16, 2026, 9:34:07 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.78% · Oct 25, 2026

ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	ngtcp2	sid	`1.24.0-1`	fixed
Debian	ngtcp2	forky	`1.24.0-1`	fixed
Debian	ngtcp2	trixie	`1.11.0-1+deb13u1`	fixed
Debian	ngtcp2	trixie-security	`1.11.0-1+deb13u1`	fixed
Debian	ngtcp2	bookworm	`0.12.1+dfsg-1+deb12u1`	fixed
Debian	ngtcp2	bookworm-security	`0.12.1+dfsg-1+deb12u1`	fixed
Cpe	ngtcp2	Not reported	`0.12.1+dfsg-1+deb12u1build0.24.04.1`	fixed
Cpe	libngtcp2-9	Not reported	`0.12.1+dfsg-1+deb12u1build0.24.04.1`	fixed
Cpe	libngtcp2-crypto-gnutls-dev	Not reported	`0.12.1+dfsg-1+deb12u1build0.24.04.1`	fixed
Cpe	libngtcp2-crypto-gnutls2	Not reported	`0.12.1+dfsg-1+deb12u1build0.24.04.1`	fixed
Cpe	libngtcp2-dev	Not reported	`0.12.1+dfsg-1+deb12u1build0.24.04.1`	fixed
Cpe	ngtcp2-client	Not reported	`0.12.1+dfsg-1+deb12u1build0.24.04.1`	fixed
Cpe	ngtcp2-server	Not reported	`0.12.1+dfsg-1+deb12u1build0.24.04.1`	fixed
Cpe	ngtcp2	Not reported	`1.22.1`	fixed
Cpe	ngtcp2	Not reported	`0.12.1+dfsg-1+deb12u1`	fixed
Alpine	ngtcp2	3.20	`1.5.0-r1`	fixed
Alpine	ngtcp2	3.21	`1.9.1-r1`	fixed
Alpine	ngtcp2	3.22	`1.12.0-r1`	fixed
Alpine	ngtcp2	3.23	`1.22.1-r0`	fixed
Alpine	ngtcp2	3.24	`1.22.1-r0`	fixed
Ubuntu	ngtcp2	pro	`0~20210905-1`	vulnerable
Ubuntu	ngtcp2	pro	`0.1.0+dfsg-1`	vulnerable
Ubuntu	ngtcp2	pro	`0.1.0+dfsg-1ubuntu0.1~esm1`	fixed
Ubuntu	ngtcp2	24.04	`0.12.1+dfsg-1`	vulnerable
Ubuntu	ngtcp2	24.04	`0.12.1+dfsg-1build1`	vulnerable
Ubuntu	ngtcp2	24.04	`0.12.1+dfsg-1build2`	vulnerable
Ubuntu	ngtcp2	24.04	`0.12.1+dfsg-1+deb12u1build0.24.04.1`	fixed
Ubuntu	ngtcp2	25.10	`1.11.0-1`	vulnerable
Ubuntu	ngtcp2	25.10	`1.11.0-1+deb13u1build0.25.10.1`	fixed
Ubuntu	ngtcp2	26.04	`1.11.0-1`	vulnerable
Ubuntu	ngtcp2	26.04	`1.16.0-1`	vulnerable
Ubuntu	ngtcp2	26.04	`1.16.0-1ubuntu0.1`	fixed
Ubuntu	ngtcp2	pro	`0~20210905-1`	vulnerable
Ubuntu	ngtcp2	pro	`0.1.0+dfsg-1`	vulnerable
Ubuntu	ngtcp2	pro	`0.1.0+dfsg-1ubuntu0.1~esm1`	fixed
Ubuntu	ngtcp2	24.04	`0.12.1+dfsg-1`	vulnerable
Ubuntu	ngtcp2	24.04	`0.12.1+dfsg-1build1`	vulnerable
Ubuntu	ngtcp2	24.04	`0.12.1+dfsg-1build2`	vulnerable
Ubuntu	ngtcp2	24.04	`0.12.1+dfsg-1+deb12u1build0.24.04.1`	fixed
Ubuntu	ngtcp2	25.10	`1.11.0-1`	vulnerable
Ubuntu	ngtcp2	25.10	`1.11.0-1+deb13u1build0.25.10.1`	fixed
Ubuntu	ngtcp2	26.04	`1.11.0-1`	vulnerable
Ubuntu	ngtcp2	26.04	`1.16.0-1`	vulnerable
Ubuntu	ngtcp2	26.04	`1.16.0-1ubuntu0.1`	fixed
Opensuse	ngtcp2	tumbleweed	`1.22.1-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	ngtcp2	source	sid	`1.22.1-1`	not yet assigned	Not reported	[1134197]
Debian	ngtcp2	source	forky	`1.22.1-1`	not yet assigned	Not reported	[1134197]
Debian	ngtcp2	source	trixie	`1.11.0-1+deb13u1`	not yet assigned	Not reported	[1134197]
Debian	ngtcp2	source	bookworm	`0.12.1+dfsg-1+deb12u1`	not yet assigned	Not reported	[1134197]
Cpe	ngtcp2	cpe	Not reported	`0.12.1+dfsg-1+deb12u1build0.24.04.1`	Not reported	Not reported	Not reported
Cpe	libngtcp2-9	cpe	Not reported	`0.12.1+dfsg-1+deb12u1build0.24.04.1`	Not reported	Not reported	Not reported
Cpe	libngtcp2-crypto-gnutls-dev	cpe	Not reported	`0.12.1+dfsg-1+deb12u1build0.24.04.1`	Not reported	Not reported	Not reported
Cpe	libngtcp2-crypto-gnutls2	cpe	Not reported	`0.12.1+dfsg-1+deb12u1build0.24.04.1`	Not reported	Not reported	Not reported
Cpe	libngtcp2-dev	cpe	Not reported	`0.12.1+dfsg-1+deb12u1build0.24.04.1`	Not reported	Not reported	Not reported
Cpe	ngtcp2-client	cpe	Not reported	`0.12.1+dfsg-1+deb12u1build0.24.04.1`	Not reported	Not reported	Not reported
Cpe	ngtcp2-server	cpe	Not reported	`0.12.1+dfsg-1+deb12u1build0.24.04.1`	Not reported	Not reported	Not reported
Cpe	ngtcp2	cpe	Not reported	`1.22.1`	Not reported	Not reported	Not reported
Cpe	ngtcp2	cpe	Not reported	`0.12.1+dfsg-1+deb12u1`	Not reported	Not reported	Not reported
Alpine	ngtcp2	apk	3.20	`1.5.0-r1`	Not reported	ALPINE-CVE-2026-40170	Not reported
Alpine	ngtcp2	apk	3.21	`1.9.1-r1`	Not reported	ALPINE-CVE-2026-40170	Not reported
Alpine	ngtcp2	apk	3.22	`1.12.0-r1`	Not reported	ALPINE-CVE-2026-40170	Not reported
Alpine	ngtcp2	apk	3.23	`1.22.1-r0`	Not reported	ALPINE-CVE-2026-40170	Not reported
Alpine	ngtcp2	apk	3.24	`1.22.1-r0`	Not reported	ALPINE-CVE-2026-40170	Not reported
Ubuntu	ngtcp2	deb	pro	`0.1.0+dfsg-1ubuntu0.1~esm1`	Not reported	UBUNTU-CVE-2026-40170	Not reported
Ubuntu	ngtcp2	deb	24.04	`0.12.1+dfsg-1+deb12u1build0.24.04.1`	Not reported	UBUNTU-CVE-2026-40170	Not reported
Ubuntu	ngtcp2	deb	25.10	`1.11.0-1+deb13u1build0.25.10.1`	Not reported	UBUNTU-CVE-2026-40170	Not reported
Ubuntu	ngtcp2	deb	26.04	`1.16.0-1ubuntu0.1`	Not reported	UBUNTU-CVE-2026-40170	Not reported
Ubuntu	ngtcp2	deb	pro	`0.1.0+dfsg-1ubuntu0.1~esm1`	Not reported	USN-8300-1	Not reported
Ubuntu	ngtcp2	deb	24.04	`0.12.1+dfsg-1+deb12u1build0.24.04.1`	Not reported	USN-8300-1	Not reported
Ubuntu	ngtcp2	deb	25.10	`1.11.0-1+deb13u1build0.25.10.1`	Not reported	USN-8300-1	Not reported
Ubuntu	ngtcp2	deb	26.04	`1.16.0-1ubuntu0.1`	Not reported	USN-8300-1	Not reported
Opensuse	ngtcp2	rpm	tumbleweed	`1.22.1-1.1`	Not reported	OPENSUSE-SU-2026:10621-1	Not reported

[Debian bug #1134197]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[libngtcp2-16]Unknown
Source package: [ngtcp2]
Details (1)
- 1.25.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.22.1-1.1
  Version impact unknown
  nvd · ngtcp2 · opensuse · tumbleweed
[libngtcp2-16-32bit]Unknown
Source package: [ngtcp2]
Details (1)
- 1.25.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.22.1-1.1
  Version impact unknown
  nvd · ngtcp2 · opensuse · tumbleweed
[libngtcp2_crypto_boringssl0]Unknown
Source package: [ngtcp2]
Details (1)
- 1.25.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.22.1-1.1
  Version impact unknown
  nvd · ngtcp2 · opensuse · tumbleweed
[libngtcp2_crypto_boringssl-devel]Unknown
Source package: [ngtcp2]
Details (1)
- 1.25.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.22.1-1.1
  Version impact unknown
  nvd · ngtcp2 · opensuse · tumbleweed
[libngtcp2_crypto_gnutls8]Unknown
Source package: [ngtcp2]
Details (1)
- 1.25.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.22.1-1.1
  Version impact unknown
  nvd · ngtcp2 · opensuse · tumbleweed
[libngtcp2_crypto_gnutls8-32bit]Unknown
Source package: [ngtcp2]
Details (1)
- 1.25.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.22.1-1.1
  Version impact unknown
  nvd · ngtcp2 · opensuse · tumbleweed
[libngtcp2_crypto_gnutls-devel]Unknown
Source package: [ngtcp2]
Details (1)
- 1.25.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.22.1-1.1
  Version impact unknown
  nvd · ngtcp2 · opensuse · tumbleweed
[libngtcp2_crypto_ossl0]Unknown
Source package: [ngtcp2]
Details (1)
- 1.25.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.22.1-1.1
  Version impact unknown
  nvd · ngtcp2 · opensuse · tumbleweed
[libngtcp2_crypto_ossl0-32bit]Unknown
Source package: [ngtcp2]
Details (1)
- 1.25.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.22.1-1.1
  Version impact unknown
  nvd · ngtcp2 · opensuse · tumbleweed
[libngtcp2_crypto_ossl-devel]Unknown
Source package: [ngtcp2]
Details (1)
- 1.25.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.22.1-1.1
  Version impact unknown
  nvd · ngtcp2 · opensuse · tumbleweed
[ngtcp2-devel]Unknown
Source package: [ngtcp2]
Details (1)
- 1.25.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.22.1-1.1
  Version impact unknown
  nvd · ngtcp2 · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[libngtcp2-16]Fixed
Source package: [ngtcp2]
Details (2)
- 1.11.0-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 1.11.0-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
[libngtcp2-9]Fixed
Source package: [ngtcp2]
Details (4)
- 0.12.1+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 0.12.1+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 0.12.1+dfsg-1+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 0.12.1+dfsg-1+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
[libngtcp2-crypto-gnutls2]Fixed
Source package: [ngtcp2]
Details (4)
- 0.12.1+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 0.12.1+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 0.12.1+dfsg-1+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 0.12.1+dfsg-1+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
[libngtcp2-crypto-gnutls8]Fixed
Source package: [ngtcp2]
Details (2)
- 1.11.0-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 1.11.0-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
[libngtcp2-crypto-gnutls-dev]Fixed
Source package: [ngtcp2]
Details (6)
- 0.12.1+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 0.12.1+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 1.11.0-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 1.11.0-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 0.12.1+dfsg-1+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 0.12.1+dfsg-1+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
[libngtcp2-dev]Fixed
Source package: [ngtcp2]
Details (6)
- 0.12.1+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 0.12.1+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 1.11.0-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 1.11.0-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 0.12.1+dfsg-1+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 0.12.1+dfsg-1+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
[ngtcp2-client]Fixed
Source package: [ngtcp2]
Details (6)
- 0.12.1+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 0.12.1+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 1.11.0-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 1.11.0-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 0.12.1+dfsg-1+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 0.12.1+dfsg-1+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
[ngtcp2-server]Fixed
Source package: [ngtcp2]
Details (6)
- 0.12.1+dfsg-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 0.12.1+dfsg-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 1.11.0-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 1.11.0-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 0.12.1+dfsg-1+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12
- 0.12.1+dfsg-1+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 0.12.1+dfsg-1+deb12u1
  nvd · ngtcp2 · debian · bookworm; nvd · ngtcp2 · debian · 12

[Debian 13 (Trixie)]

[libngtcp2-16]Fixed
Source package: [ngtcp2]
Details (6)
- 1.11.0-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.11.0-1+deb13u1
  nvd · ngtcp2 · debian · 13
- 1.11.0-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.11.0-1+deb13u1
  nvd · ngtcp2 · debian · 13
- 1.22.1-1~bpo13+1 · amd64 · trixie-backports
  Fixed · Fixed: 1.11.0-1+deb13u1
  nvd · ngtcp2 · debian · 13
- 1.22.1-1~bpo13+1 · arm64 · trixie-backports
  Fixed · Fixed: 1.11.0-1+deb13u1
  nvd · ngtcp2 · debian · 13
- 1.11.0-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.11.0-1+deb13u1
  nvd · ngtcp2 · debian · 13
- 1.11.0-1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 1.11.0-1+deb13u1
  nvd · ngtcp2 · debian · 13

Next results

Observed: Oct 27, 2026, 7:59:05 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]