USN-8300-1: ngtcp2 vulnerability

Publication date

25 May 2026

Overview

ngtcp2 could be made to run programs as your login if it received specially crafted network traffic when qlog was enabled.


Packages

  • ngtcp2 - RFC9000 QUIC protocol implementation

Details

Zou Dikai discovered that ngtcp2 serialized peer transport parameters into
a fixed 1024-byte stack buffer without bounds checking. When qlog was
enabled, a remote attacker could possibly use this issue to execute
arbitrary code.

Zou Dikai discovered that ngtcp2 serialized peer transport parameters into
a fixed 1024-byte stack buffer without bounds checking. When qlog was
enabled, a remote attacker could possibly use this issue to execute
arbitrary code.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.04 LTS resolute libngtcp2-16 –  1.16.0-1ubuntu0.1
libngtcp2-crypto-gnutls-dev –  1.16.0-1ubuntu0.1
libngtcp2-crypto-gnutls8 –  1.16.0-1ubuntu0.1
libngtcp2-crypto-ossl-dev –  1.16.0-1ubuntu0.1
libngtcp2-crypto-ossl0 –  1.16.0-1ubuntu0.1
libngtcp2-dev –  1.16.0-1ubuntu0.1
25.10 questing libngtcp2-16 –  1.11.0-1+deb13u1build0.25.10.1
libngtcp2-crypto-gnutls-dev –  1.11.0-1+deb13u1build0.25.10.1
libngtcp2-crypto-gnutls8 –  1.11.0-1+deb13u1build0.25.10.1
libngtcp2-dev –  1.11.0-1+deb13u1build0.25.10.1
ngtcp2-client –  1.11.0-1+deb13u1build0.25.10.1
ngtcp2-server –  1.11.0-1+deb13u1build0.25.10.1
24.04 LTS noble libngtcp2-9 –  0.12.1+dfsg-1+deb12u1build0.24.04.1
libngtcp2-crypto-gnutls-dev –  0.12.1+dfsg-1+deb12u1build0.24.04.1
libngtcp2-crypto-gnutls2 –  0.12.1+dfsg-1+deb12u1build0.24.04.1
libngtcp2-dev –  0.12.1+dfsg-1+deb12u1build0.24.04.1
ngtcp2-client –  0.12.1+dfsg-1+deb12u1build0.24.04.1
ngtcp2-server –  0.12.1+dfsg-1+deb12u1build0.24.04.1
22.04 LTS jammy libngtcp2-0 –  0.1.0+dfsg-1ubuntu0.1~esm1  
libngtcp2-crypto-gnutls-dev –  0.1.0+dfsg-1ubuntu0.1~esm1  
libngtcp2-crypto-gnutls0 –  0.1.0+dfsg-1ubuntu0.1~esm1  
libngtcp2-dev –  0.1.0+dfsg-1ubuntu0.1~esm1  
ngtcp2-client –  0.1.0+dfsg-1ubuntu0.1~esm1  
ngtcp2-server –  0.1.0+dfsg-1ubuntu0.1~esm1  

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.


Have additional questions?

Talk to a member of the team ›