{"cve":"CVE-2026-40898","nvd":{"published":"2026-06-04T19:16:28.713","modified":"2026-07-22T20:10:00.127","status":"Analyzed","description":"quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or large values. The implementation builds an `http.Header` for the corresponding `http.Request` or `http.Response`, while only enforcing limits on the size of the QPACK-compressed HEADERS frame, not on the decoded field section. This can lead to memory exhaustion. This is very similar to CVE-2025-64702. The difference is that this issue uses HTTP trailers, rather than HTTP headers, as the attack vector. A misbehaving or malicious peer can cause a denial-of-service (DoS) attack against quic-go's HTTP/3 servers or clients by triggering excessive memory allocation, potentially leading to crashes or resource exhaustion. This affects both servers and clients due to symmetric header construction. Version 0.59.1 enforces RFC 9114 decoded field section size limits for trailers as well. It incrementally decodes QPACK entries and checks the field section size after each entry, aborting the stream if an entry causes the limit to be exceeded.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-770"],"references":["https://github.com/quic-go/quic-go/releases/tag/v0.59.1","https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9"],"products":["quic-go_project:quic-go"],"source":"nvd","synced_at":"2026-10-19T22:37:48.043517290+00:00"},"epss":{"cve":"CVE-2026-40898","score":0.00396,"percentile":0.33792,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-vvgj-x9jq-8cj9","url":"https://osv.dev/vulnerability/GHSA-vvgj-x9jq-8cj9","summary":"quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion ","modified":"2026-09-10T03:50:50.767785787Z","packages":[{"ecosystem":"Go","name":"github.com/quic-go/quic-go","purl":"pkg:golang/github.com/quic-go/quic-go","ranges":["<0.59.1"],"fixed":["0.59.1"]}]},{"id":"GO-2026-5676","url":"https://osv.dev/vulnerability/GO-2026-5676","summary":"HTTP/3 QPACK Trailer Expansion Memory Exhaustion in github.com/quic-go/quic-go","modified":"2026-07-25T21:44:40.393974344Z","packages":[{"ecosystem":"Go","name":"github.com/quic-go/quic-go","purl":"pkg:golang/github.com/quic-go/quic-go","ranges":["<0.59.1"],"fixed":["0.59.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}