CVE-2026-40898High· 7.5▾ TwilightA flaw was found in quic-go, an implementation of the QUIC protocol in Go. A remote attacker can exploit this by sending specially crafted HTTP/3 trailer fields. This can cause the system to allocate excessive memory, leading to a denial-o…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
0.4% → 0.5%
5.3 → 7.5
medium → high
Last analysed / modified upstream
A flaw was found in quic-go, an implementation of the QUIC protocol in Go. A remote attacker can exploit this by sending specially crafted HTTP/3 trailer fields. This can cause the system to allocate excessive memory, leading to a denial-of-service (DoS) condition where the affected server or client may crash or run out of resources.
github.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers — rated Important by Red Hat. Released 2026-06-04, updated 2026-10-09.
Affected:
Fixed:
No fix planned:
Not affected:
For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:50336 For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:50318 For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:50319
Workarounds / mitigations:
Affected packages:
github.com/quic-go/quic-go < 0.59.1Patched in:
github.com/quic-go/quic-go 0.59.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-11374Medium· 6.5github.com/hashicorp/consul: Consul's KV endpoint is vulnerable to denial of service (CVE-2025-11374)
CVE-2023-30551High· 7.5rekor: compressed archives can result in OOM conditions (CVE-2023-30551)
CVE-2024-47874High· 7.5starlette: Starlette Denial of service (DoS) via multipart/form-data (CVE-2024-47874)
CVE-2026-114136High· 7.5djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser (CVE-2026-114136)
CVE-2026-116141Medium· 5.3ImageMagick: ImageMagick: Denial of Service via policy bypass in UHDR decoder (CVE-2026-116141)
CVE-2026-114052High· 7.5vllm: vLLM: Denial of Service via unbounded processor caching in MOSS-Audio (CVE-2026-114052)