{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/quic-go--0.56.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:quic-go_project:quic-go:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.3,"id":"CVE-2026-40898"},{"cvss":5.3,"id":"CVE-2025-64702"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":[],"_cs_products":["quic-go (\u003c= 0.56.0)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability","network","http3","quic","golang"],"_cs_type":"advisory","_cs_vendors":["quic-go_project"],"content_html":"\u003cp\u003eCVE-2026-40898 details a severe denial-of-service (DoS) vulnerability affecting \u003ccode\u003equic-go\u003c/code\u003e, a popular open-source implementation of the QUIC protocol in Go. Prior to version 0.59.1, both HTTP/3 client and server implementations are susceptible to excessive memory allocation. This occurs when an attacker sends a QPACK-encoded HEADERS frame containing a large trailer field section with numerous unique field names or extensive values. The \u003ccode\u003equic-go\u003c/code\u003e library, failing to enforce limits on the decoded field section size (only on the compressed frame size), attempts to construct an \u003ccode\u003ehttp.Header\u003c/code\u003e object using an exorbitant amount of memory. This can lead to system resource exhaustion, causing applications using \u003ccode\u003equic-go\u003c/code\u003e to crash or become unresponsive. The vulnerability is similar to CVE-2025-64702 but specifically targets HTTP trailers.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eAttacker Establishes QUIC Connection:\u003c/strong\u003e A remote attacker identifies a target system or application utilizing a \u003ccode\u003equic-go\u003c/code\u003e based HTTP/3 service and initiates a QUIC connection.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMalicious QPACK Frame Crafting:\u003c/strong\u003e The attacker constructs a specially malformed QPACK-encoded HEADERS frame, embedding a significantly large trailer field section with a high count of unique field names and/or large data values.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eFrame Transmission:\u003c/strong\u003e The attacker transmits this crafted QPACK HEADERS frame over the established QUIC connection to the vulnerable \u003ccode\u003equic-go\u003c/code\u003e HTTP/3 service.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVulnerable Processing:\u003c/strong\u003e The \u003ccode\u003equic-go\u003c/code\u003e library, operating on versions prior to 0.59.1, begins to process and decode the incoming malicious QPACK HEADERS frame.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExcessive Memory Allocation:\u003c/strong\u003e Due to the absence of decoded field section size limits, the \u003ccode\u003equic-go\u003c/code\u003e implementation allocates an inordinate amount of memory to build the \u003ccode\u003ehttp.Header\u003c/code\u003e object representing the large trailer section.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eResource Exhaustion:\u003c/strong\u003e The continuous and unchecked memory allocation rapidly consumes available system memory, leading to resource exhaustion on the host running the \u003ccode\u003equic-go\u003c/code\u003e application.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eApplication Crash/Unavailability:\u003c/strong\u003e The \u003ccode\u003equic-go\u003c/code\u003e based application either crashes, becomes unresponsive, or the entire host experiences a denial-of-service, disrupting critical services.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-40898 directly results in a denial-of-service (DoS) condition for applications leveraging the \u003ccode\u003equic-go\u003c/code\u003e library for HTTP/3 communication. This can manifest as application crashes, frequent service restarts, or complete system unresponsiveness due to resource exhaustion (specifically memory). While specific victim counts or sectors are not available, any organization deploying services or clients built with vulnerable versions of \u003ccode\u003equic-go\u003c/code\u003e (prior to 0.59.1) is at risk. The operational impact could range from temporary service disruption to prolonged outages, depending on the targeted application's criticality and the attacker's sustained efforts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch CVE-2026-40898 Immediately:\u003c/strong\u003e Upgrade all applications using the \u003ccode\u003equic-go\u003c/code\u003e library to version 0.59.1 or later to mitigate CVE-2026-40898.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDeploy Sigma Rules:\u003c/strong\u003e Deploy the provided Sigma rules to your SIEM solution to detect application crashes and excessive restarts that could indicate CVE-2026-40898 exploitation.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMonitor HTTP/3 Service Health:\u003c/strong\u003e Implement robust monitoring for applications functioning as HTTP/3 servers or clients to detect unusual memory consumption, high CPU usage, or unexpected process terminations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T09:35:56Z","date_published":"2026-06-14T22:37:58Z","id":"https://feed.craftedsignal.io/briefs/2026-06-quic-go-memory-exhaustion-dos/","summary":"A vulnerability in quic-go, an implementation of the QUIC protocol in Go, allows a remote attacker to cause a denial-of-service (DoS) condition by sending specially crafted QPACK-encoded HEADERS frames with large trailer field sections, leading to excessive memory allocation in affected HTTP/3 client and server implementations prior to version 0.59.1.","title":"CVE-2026-40898: quic-go HTTP/3 Memory Exhaustion DoS","url":"https://feed.craftedsignal.io/briefs/2026-06-quic-go-memory-exhaustion-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Quic-Go (\u003c= 0.56.0)","version":"https://jsonfeed.org/version/1.1"}