CyberSecBulletin

Ngtcp2 vulnerabilities

We track 2 vulnerabilities in Ngtcp2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on April 16, 2026.

2vulnerabilities
0critical
2high
0exploited
7.8average CVSS score

Latest Ngtcp2 vulnerabilities

  • 7.5 High severity

    ngtcp2: Stack-based Buffer Overflow

    CVE-2026-40170Ngtcp2

    ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote

  • 8.2 High severity

    ngtcp2: Always-Incorrect Control Flow Implementation

    CVE-2024-52811Ngtcp2

    The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a buffer overflow. In `ngtcp2_conn::conn_recv_pkt` for an ACK, there was new logic that got added to s