CVE-2026-40898

Name of the Vulnerable Software and Affected Versions quic-go (affected versions not specified)

Description An attacker can trigger excessive memory allocation in the HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame. This frame decodes into a large trailer field section containing numerous unique field names or large values. The system constructs an http.Header for the http.Request or http.Response but only enforces limits on the size of the compressed HEADERS frame rather than the decoded field section. This discrepancy allows a maliciously crafted frame to expand up to 50 times its encoded size using QPACK static table entries, leading to memory exhaustion and a denial-of-service (DoS) state.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.