{"id":"EUVD-2026-34312","revision":"7d2fd30c2a33417d819d3bc170300a59","records":[{"revision":"7d2fd30c2a33417d819d3bc170300a59","observedAt":"2026-11-01T07:05:09.483+00:00","statement":{"source":"euvd","id":"EUVD-2026-34312","aliases":["CVE-2026-40898","GHSA-vvgj-x9jq-8cj9"],"title":"quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes …","description":"quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or large values. The implementation builds an `http.Header` for the corresponding `http.Request` or `http.Response`, while only enforcing limits on the size of the QPACK-compressed HEADERS frame, not on the decoded field section. This can lead to memory exhaustion. This is very similar to CVE-2025-64702. The difference is that this issue uses HTTP trailers, rather than HTTP headers, as the attack vector. A misbehaving or malicious peer can cause a denial-of-service (DoS) attack against quic-go's HTTP/3 servers or clients by triggering excessive memory allocation, potentially leading to crashes or resource exhaustion. This affects both servers and clients due to symmetric header construction. Version 0.59.1 enforces RFC 9114 decoded field section size limits for trailers as well. It incrementally decodes QPACK entries and checks the field section size after each entry, aborting the stream if an entry causes the limit to be exceeded.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":null}],"references":["https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9","https://github.com/quic-go/quic-go/releases/tag/v0.59.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-34312","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 4, 2026, 5:43:36 PM","dateUpdated":"Jun 4, 2026, 6:40:44 PM"},"relatedAdvisories":[{"id":"RHSA-2026:50319","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","vulnerabilityIds":["CVE-2026-12383","CVE-2026-27145","CVE-2026-33811","CVE-2026-34993","CVE-2026-39820","CVE-2026-40898","CVE-2026-42499","CVE-2026-42504","CVE-2026-44545","CVE-2026-48526","CVE-2026-54059","CVE-2026-54060","CVE-2026-55379","CVE-2026-55380","CVE-2026-59197","CVE-2026-59885","CVE-2026-59886"]},{"id":"RHSA-2026:53734","title":"Red Hat Security Advisory: OpenShift Virtualization v4.21 Images","vulnerabilityIds":["CVE-2026-40898"]},{"id":"RHSA-2026:50340","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Container Release Update","vulnerabilityIds":["CVE-2026-11332","CVE-2026-12383","CVE-2026-13149","CVE-2026-13676","CVE-2026-18141","CVE-2026-34993","CVE-2026-40898","CVE-2026-44545","CVE-2026-48526","CVE-2026-48990","CVE-2026-54058","CVE-2026-54060","CVE-2026-54283","CVE-2026-55379","CVE-2026-55380","CVE-2026-59197","CVE-2026-59886","CVE-2026-59939"]},{"id":"RHSA-2026:40223","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-40898"]},{"id":"RHSA-2026:15862","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-40898","CVE-2026-44432","CVE-2026-45287","CVE-2026-53489","CVE-2026-53492"]},{"id":"RHSA-2026:50318","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update","vulnerabilityIds":["CVE-2026-40898"]},{"id":"RHSA-2026:50479","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update","vulnerabilityIds":["CVE-2026-8643","CVE-2026-9595","CVE-2026-11332","CVE-2026-13149","CVE-2026-13676","CVE-2026-18141","CVE-2026-34993","CVE-2026-40898","CVE-2026-44545","CVE-2026-48990","CVE-2026-54058","CVE-2026-54060","CVE-2026-54283","CVE-2026-55379","CVE-2026-55380","CVE-2026-59197","CVE-2026-59869","CVE-2026-59886","CVE-2026-59939"]},{"id":"RHSA-2026:50336","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","vulnerabilityIds":["CVE-2026-12383","CVE-2026-18141","CVE-2026-33811","CVE-2026-34993","CVE-2026-39820","CVE-2026-40898","CVE-2026-42499","CVE-2026-42504","CVE-2026-44545","CVE-2026-48526","CVE-2026-54059","CVE-2026-54060","CVE-2026-55379","CVE-2026-55380","CVE-2026-59197","CVE-2026-59885","CVE-2026-59886"]},{"id":"RHSA-2026:62260","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.30.0 Release.","vulnerabilityIds":["CVE-2025-55163","CVE-2026-8286","CVE-2026-9277","CVE-2026-9547","CVE-2026-9563","CVE-2026-10050","CVE-2026-10051","CVE-2026-12143","CVE-2026-12151","CVE-2026-13149","CVE-2026-15075","CVE-2026-15076","CVE-2026-27136","CVE-2026-34986","CVE-2026-39820","CVE-2026-39831","CVE-2026-39835","CVE-2026-40898","CVE-2026-40983","CVE-2026-40984","CVE-2026-41242","CVE-2026-41695","CVE-2026-41716","CVE-2026-42264","CVE-2026-42499","CVE-2026-44705","CVE-2026-45149","CVE-2026-45416","CVE-2026-45623","CVE-2026-45674","CVE-2026-46597","CVE-2026-46681","CVE-2026-47691","CVE-2026-48020","CVE-2026-48068","CVE-2026-48491","CVE-2026-49978","CVE-2026-50010","CVE-2026-50193","CVE-2026-53488","CVE-2026-53492","CVE-2026-53622","CVE-2026-54399","CVE-2026-54428","CVE-2026-54512","CVE-2026-54513","CVE-2026-54763","CVE-2026-55831","CVE-2026-55833","CVE-2026-56745","CVE-2026-56746","CVE-2026-56819","CVE-2026-59296","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59877","CVE-2026-59888","CVE-2026-59899","CVE-2026-65600","CVE-2026-65601","CVE-2026-67213","CVE-2026-67214","CVE-2026-68494","CVE-2026-69152","CVE-2026-69153","CVE-2026-73086","CVE-2026-73566","CVE-2026-73646","CVE-2026-75838"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-34312","identifiers":["EUVD-2026-34312","CVE-2026-40898","GHSA-vvgj-x9jq-8cj9"]},"retained":false,"historicalAffected":[]}],"coverage":[]}