--- id: CVE-2026-40898 title: >- github.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers (CVE-2026-40898) summary: >- A flaw was found in quic-go, an implementation of the QUIC protocol in Go. A remote attacker can exploit this by sending specially crafted HTTP/3 trailer fields. This can cause the system to allocate excessive memory, leading to a denial-o… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cvssSource: vendor cwe: CWE-770 vendor: Red Hat product: Red Hat Ansible Automation Platform 2.6 for RHEL 9 affected: - advanced_cluster_management_for_kubernetes 2 - ansible_automation_platform 2 - openshift_container_platform 4 - ansible_automation_platform_2_6_for_rhel 10 - ansible_automation_platform_2_7_for_rhel 10 - ansible_automation_platform_2_5_for_rhel 8 - ansible_automation_platform_2_5_for_rhel 9 - ansible_automation_platform_2_6_for_rhel 9 - ansible_automation_platform_2_7_for_rhel 9 - ansible_automation_platform 2.6 - ansible_automation_platform 2.7 - container_native_virtualization 4.21 - hardened_images - openshift_dev_spaces 3.30 patched: - ansible_automation_platform_2_6_for_rhel 10 - ansible_automation_platform_2_7_for_rhel 10 - ansible_automation_platform_2_5_for_rhel 8 - ansible_automation_platform_2_5_for_rhel 9 - ansible_automation_platform_2_6_for_rhel 9 - ansible_automation_platform_2_7_for_rhel 9 - ansible_automation_platform 2.6 - ansible_automation_platform 2.7 - container_native_virtualization 4.21 - hardened_images - openshift_dev_spaces 3.30 published: '2026-06-04' updated: '2026-10-09' sourceUpdated: '2026-10-09T22:33:03+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40898.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40898.json - url: 'https://access.redhat.com/security/cve/CVE-2026-40898' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2484875' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-40898' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-40898' - url: 'https://github.com/quic-go/quic-go/releases/tag/v0.59.1' - url: 'https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9' - url: 'https://access.redhat.com/errata/RHSA-2026:50336' - url: 'https://access.redhat.com/errata/RHSA-2026:50318' - url: 'https://access.redhat.com/errata/RHSA-2026:50319' - url: 'https://access.redhat.com/errata/RHSA-2026:50479' - url: 'https://access.redhat.com/errata/RHSA-2026:50340' - url: 'https://access.redhat.com/errata/RHSA-2026:53734' - url: 'https://access.redhat.com/errata/RHSA-2026:40223' - url: 'https://access.redhat.com/errata/RHSA-2026:15862' - url: 'https://access.redhat.com/errata/RHSA-2026:62260' - url: 'https://github.com/quic-go/quic-go/pull/5642' - url: >- https://github.com/quic-go/quic-go/commit/c56e8c79d1627cc1ed6005b421b4b0adadd83665 - url: 'https://github.com/advisories/GHSA-g754-hx8w-x2g6' - url: 'https://github.com/quic-go/quic-go' tags: - csaf - vex - red-hat - osv - go - score-dispute epss: 0.00396 epssPercentile: 0.33594 aliases: - GHSA-vvgj-x9jq-8cj9 - GO-2026-5676 ecosystem: go scores: vendor: 7.5 osv: 5.3 ingestedAt: '2026-07-09T18:56:36.944Z' --- ## Overview A flaw was found in quic-go, an implementation of the QUIC protocol in Go. A remote attacker can exploit this by sending specially crafted HTTP/3 trailer fields. This can cause the system to allocate excessive memory, leading to a denial-of-service (DoS) condition where the affected server or client may crash or run out of resources. ## Vendor advisories - **RHSA-2026:50336** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50336) - **RHSA-2026:50318** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 for RHEL 10, Red Hat Ansible Automation Platform 2.7 for RHEL 9 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50318) - **RHSA-2026:50319** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50319) - **RHSA-2026:50479** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50479) - **RHSA-2026:50340** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50340) - **RHSA-2026:53734** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.21 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53734) - **RHSA-2026:40223** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:40223) - **RHSA-2026:15862** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-05-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:15862) - **RHSA-2026:62260** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62260) - **Red Hat VEX** · Important · affected: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ansible Automation Platform 2, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ansible Automation Platform 2, Red Hat OpenShift Container Platform 4 · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40898.json) **github.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers** — rated Important by Red Hat. Released 2026-06-04, updated 2026-10-09. Affected: - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Ansible Automation Platform 2 - Red Hat OpenShift Container Platform 4 Fixed: - Red Hat Ansible Automation Platform 2.6 for RHEL 10 - Red Hat Ansible Automation Platform 2.7 for RHEL 10 - Red Hat Ansible Automation Platform 2.5 for RHEL 8 - Red Hat Ansible Automation Platform 2.5 for RHEL 9 - Red Hat Ansible Automation Platform 2.6 for RHEL 9 - Red Hat Ansible Automation Platform 2.7 for RHEL 9 - Red Hat Ansible Automation Platform 2.6 - Red Hat Ansible Automation Platform 2.7 - Red Hat Container Native Virtualization 4.21 - Red Hat Hardened Images - Red Hat OpenShift Dev Spaces 3.30 No fix planned: - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Ansible Automation Platform 2 - Red Hat OpenShift Container Platform 4 Not affected: - Red Hat Ansible Automation Platform 2.6 for RHEL 10 - Red Hat Ansible Automation Platform 2.7 for RHEL 10 - Red Hat Ansible Automation Platform 2.5 for RHEL 8 - Red Hat Ansible Automation Platform 2.5 for RHEL 9 - Red Hat Ansible Automation Platform 2.6 for RHEL 9 - Red Hat Ansible Automation Platform 2.7 for RHEL 9 - Red Hat Ansible Automation Platform 2.6 - Red Hat Ansible Automation Platform 2.7 - Red Hat OpenShift Dev Spaces 3.30 - OpenShift Service Mesh 2 ## Remediation For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:50336 For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:50318 For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:50319 Workarounds / mitigations: - Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. ## Package advisory (CVE-2026-40898) Affected packages: - `github.com/quic-go/quic-go < 0.59.1` Patched in: - `github.com/quic-go/quic-go 0.59.1` Source: https://osv.dev/vulnerability/GHSA-vvgj-x9jq-8cj9