Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-17 | 2 | Disclosure1Patch1 |
| 2026-04-19 | 1 | Disclosure1 |
CVE-2026-40170: ngtcp2: ngtcp2_qlog_parameters_set_transport_params() stack buffer overflow https://www.openwall.com/lists/oss-security/2026/04/17/12 serializes transport parameters into a fixed stack buffer (uint8_t buf[1024]) without complete bounds checks
Post summary
The post discloses a stack buffer overflow in ngtcp2, providing technical details but no PoC, exploit, or patch information.
kusanagi-ngtcp2 Module Update 1.22.1-1 https://kusanagi.tokyo/en/releases/24356/ KUSANAGI 9 modules have been updated. The updated modules are as follows: ngtcp2 1.22.1-1 This update includes support for vulnerability(CVE-2026-40170). The module update can be applied with the following...
Post summary
The text announces a module update for kusanagi-ngtcp2 that contains a fix for CVE-2026-40170, providing a patch without listing any exploit details or active exploitation.
CVE-2026-40170 ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameter… https://www.cve.org/CVERecord?id=CVE-2026-40170
Post summary
The notice reports a serialization bug in ngtcp2 prior to 1.22.1, providing technical details but no PoC, exploit, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | tatsuhiro-t | ngtcp2 | - | - | - |