CVE-2026-40898
quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion
Description
quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or large values. The implementation builds an `http.Header` for the corresponding `http.Request` or `http.Response`, while only enforcing limits on the size of the QPACK-compressed HEADERS frame, not on the decoded field section. This can lead to memory exhaustion. This is very similar to CVE-2025-64702. The difference is that this issue uses HTTP trailers, rather than HTTP headers, as the attack vector. A misbehaving or malicious peer can cause a denial-of-service (DoS) attack against quic-go's HTTP/3 servers or clients by triggering excessive memory allocation, potentially leading to crashes or resource exhaustion. This affects both servers and clients due to symmetric header construction. Version 0.59.1 enforces RFC 9114 decoded field section size limits for trailers as well. It incrementally decodes QPACK entries and checks the field section size after each entry, aborting the stream if an entry causes the limit to be exceeded.
INFO
Published Date :
June 4, 2026, 7:16 p.m.
Last Modified :
July 22, 2026, 8:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update quic-go to version 0.59.1.
- Ensure RFC 9114 decoded field section size limits are enforced.
- Validate trailer size limits.
Public PoC/Exploit Available at Github
CVE-2026-40898 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-40898.
| URL | Resource |
|---|---|
| https://github.com/quic-go/quic-go/releases/tag/v0.59.1 | Product Release Notes |
| https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9 | Mitigation Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-40898 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-40898
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
(S)AGE - (Sovereign) Agent Governed Experience
agentic-ai artificial-intelligence bft-consensus bft-network distributed-systems governance
Makefile Go Shell Python JavaScript CSS HTML NSIS Swift Dockerfile
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-40898 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-40898 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 22, 2026
Action Type Old Value New Value Added Translation Title: quic-go, Description: quic-go es una implementación del protocolo QUIC en Go. Antes de la versión 0.59.1, un atacante puede causar una asignación de memoria excesiva en las implementaciones de cliente y servidor HTTP/3 de quic-go al enviar una trama HEADERS codificada en QPACK que se decodifica en una sección de campo de tráiler grande con muchos nombres de campo únicos y/o valores grandes. La implementación construye un 'http.Header' para el 'http.Request' o 'http.Response' correspondiente, mientras que solo aplica límites al tamaño de la trama HEADERS comprimida con QPACK, no a la sección de campo decodificada. Esto puede llevar al agotamiento de la memoria. Esto es muy similar a CVE-2025-64702. La diferencia es que este problema utiliza tráileres HTTP, en lugar de encabezados HTTP, como vector de ataque. Un par con comportamiento incorrecto o malicioso puede causar un ataque de denegación de servicio (DoS) contra los servidores o clientes HTTP/3 de quic-go al desencadenar una asignación de memoria excesiva, lo que podría llevar a fallos o agotamiento de recursos. Esto afecta tanto a servidores como a clientes debido a la construcción simétrica de encabezados. La versión 0.59.1 aplica los límites de tamaño de la sección de campo decodificada de RFC 9114 también para los tráileres. Decodifica incrementalmente las entradas QPACK y verifica el tamaño de la sección de campo después de cada entrada, abortando el flujo si una entrada hace que se exceda el límite. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'quic-go', 'product': 'quic-go', 'versions': [{'status': 'affected', 'version': '< 0.59.1'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-40898', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-04T18:40:25.619349Z'} -
Initial Analysis by [email protected]
Jun. 05, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Added CPE Configuration OR *cpe:2.3:a:quic-go_project:quic-go:*:*:*:*:*:*:*:* versions up to (excluding) 0.59.1 Added Reference Type GitHub, Inc.: https://github.com/quic-go/quic-go/releases/tag/v0.59.1 Types: Product, Release Notes Added Reference Type GitHub, Inc.: https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9 Types: Mitigation, Vendor Advisory -
New CVE Received by [email protected]
Jun. 04, 2026
Action Type Old Value New Value Added Description quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or large values. The implementation builds an `http.Header` for the corresponding `http.Request` or `http.Response`, while only enforcing limits on the size of the QPACK-compressed HEADERS frame, not on the decoded field section. This can lead to memory exhaustion. This is very similar to CVE-2025-64702. The difference is that this issue uses HTTP trailers, rather than HTTP headers, as the attack vector. A misbehaving or malicious peer can cause a denial-of-service (DoS) attack against quic-go's HTTP/3 servers or clients by triggering excessive memory allocation, potentially leading to crashes or resource exhaustion. This affects both servers and clients due to symmetric header construction. Version 0.59.1 enforces RFC 9114 decoded field section size limits for trailers as well. It incrementally decodes QPACK entries and checks the field section size after each entry, aborting the stream if an entry causes the limit to be exceeded. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Added CWE CWE-770 Added Reference https://github.com/quic-go/quic-go/releases/tag/v0.59.1 Added Reference https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9