{"id":"CVE-2026-40898","title":"github.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers (CVE-2026-40898)","summary":"A flaw was found in quic-go, an implementation of the QUIC protocol in Go. A remote attacker can exploit this by sending specially crafted HTTP/3 trailer fields. This can cause the system to allocate excessive memory, leading to a denial-o…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-770","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","affected":["advanced_cluster_management_for_kubernetes 2","ansible_automation_platform 2","openshift_container_platform 4","ansible_automation_platform_2_6_for_rhel 10","ansible_automation_platform_2_7_for_rhel 10","ansible_automation_platform_2_5_for_rhel 8","ansible_automation_platform_2_5_for_rhel 9","ansible_automation_platform_2_6_for_rhel 9","ansible_automation_platform_2_7_for_rhel 9","ansible_automation_platform 2.6","ansible_automation_platform 2.7","container_native_virtualization 4.21","hardened_images","openshift_dev_spaces 3.30"],"patched":["ansible_automation_platform_2_6_for_rhel 10","ansible_automation_platform_2_7_for_rhel 10","ansible_automation_platform_2_5_for_rhel 8","ansible_automation_platform_2_5_for_rhel 9","ansible_automation_platform_2_6_for_rhel 9","ansible_automation_platform_2_7_for_rhel 9","ansible_automation_platform 2.6","ansible_automation_platform 2.7","container_native_virtualization 4.21","hardened_images","openshift_dev_spaces 3.30"],"published":"2026-06-04","updated":"2026-10-09","sourceUpdated":"2026-10-09T22:33:03+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40898.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40898.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-40898"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484875"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40898"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40898"},{"url":"https://github.com/quic-go/quic-go/releases/tag/v0.59.1"},{"url":"https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9"},{"url":"https://access.redhat.com/errata/RHSA-2026:50336"},{"url":"https://access.redhat.com/errata/RHSA-2026:50318"},{"url":"https://access.redhat.com/errata/RHSA-2026:50319"},{"url":"https://access.redhat.com/errata/RHSA-2026:50479"},{"url":"https://access.redhat.com/errata/RHSA-2026:50340"},{"url":"https://access.redhat.com/errata/RHSA-2026:53734"},{"url":"https://access.redhat.com/errata/RHSA-2026:40223"},{"url":"https://access.redhat.com/errata/RHSA-2026:15862"},{"url":"https://access.redhat.com/errata/RHSA-2026:62260"},{"url":"https://github.com/quic-go/quic-go/pull/5642"},{"url":"https://github.com/quic-go/quic-go/commit/c56e8c79d1627cc1ed6005b421b4b0adadd83665"},{"url":"https://github.com/advisories/GHSA-g754-hx8w-x2g6"},{"url":"https://github.com/quic-go/quic-go"}],"tags":["csaf","vex","red-hat","osv","go","score-dispute"],"epss":0.00396,"epssPercentile":0.33594,"aliases":["GHSA-vvgj-x9jq-8cj9","GO-2026-5676"],"ecosystem":"go","scores":{"vendor":7.5,"osv":5.3},"ingestedAt":"2026-07-09T18:56:36.944Z","slug":"CVE-2026-40898","body":"## Overview\n\nA flaw was found in quic-go, an implementation of the QUIC protocol in Go. A remote attacker can exploit this by sending specially crafted HTTP/3 trailer fields. This can cause the system to allocate excessive memory, leading to a denial-of-service (DoS) condition where the affected server or client may crash or run out of resources.\n\n## Vendor advisories\n\n- **RHSA-2026:50336** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50336)\n- **RHSA-2026:50318** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 for RHEL 10, Red Hat Ansible Automation Platform 2.7 for RHEL 9 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50318)\n- **RHSA-2026:50319** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50319)\n- **RHSA-2026:50479** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50479)\n- **RHSA-2026:50340** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50340)\n- **RHSA-2026:53734** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.21 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53734)\n- **RHSA-2026:40223** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:40223)\n- **RHSA-2026:15862** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-05-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:15862)\n- **RHSA-2026:62260** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62260)\n- **Red Hat VEX** · Important · affected: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ansible Automation Platform 2, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ansible Automation Platform 2, Red Hat OpenShift Container Platform 4 · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40898.json)\n\n**github.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers** — rated Important by Red Hat. Released 2026-06-04, updated 2026-10-09.\n\nAffected:\n\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift Container Platform 4\n\nFixed:\n\n- Red Hat Ansible Automation Platform 2.6 for RHEL 10\n- Red Hat Ansible Automation Platform 2.7 for RHEL 10\n- Red Hat Ansible Automation Platform 2.5 for RHEL 8\n- Red Hat Ansible Automation Platform 2.5 for RHEL 9\n- Red Hat Ansible Automation Platform 2.6 for RHEL 9\n- Red Hat Ansible Automation Platform 2.7 for RHEL 9\n- Red Hat Ansible Automation Platform 2.6\n- Red Hat Ansible Automation Platform 2.7\n- Red Hat Container Native Virtualization 4.21\n- Red Hat Hardened Images\n- Red Hat OpenShift Dev Spaces 3.30\n\nNo fix planned:\n\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift Container Platform 4\n\nNot affected:\n\n- Red Hat Ansible Automation Platform 2.6 for RHEL 10\n- Red Hat Ansible Automation Platform 2.7 for RHEL 10\n- Red Hat Ansible Automation Platform 2.5 for RHEL 8\n- Red Hat Ansible Automation Platform 2.5 for RHEL 9\n- Red Hat Ansible Automation Platform 2.6 for RHEL 9\n- Red Hat Ansible Automation Platform 2.7 for RHEL 9\n- Red Hat Ansible Automation Platform 2.6\n- Red Hat Ansible Automation Platform 2.7\n- Red Hat OpenShift Dev Spaces 3.30\n- OpenShift Service Mesh 2\n\n## Remediation\n\nFor details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:50336\nFor details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:50318\nFor details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:50319\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2026-40898)\n\nAffected packages:\n\n- `github.com/quic-go/quic-go < 0.59.1`\n\nPatched in:\n\n- `github.com/quic-go/quic-go 0.59.1`\n\nSource: https://osv.dev/vulnerability/GHSA-vvgj-x9jq-8cj9","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":214823,"id":"CVE-2026-40898","ts":1790927910613,"field":"cvss","old":"5.3","new":"7.5"},{"seq":214822,"id":"CVE-2026-40898","ts":1790927910613,"field":"severity","old":"medium","new":"high"}]}