The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a buffer overflow. In `ngtcp2_conn::conn_recv_pkt` for an ACK, there was new logic that got added to skip `conn_recv_ack` if an ack has already been processed in the payload. However, this causes us to also skip `ngtcp2_pkt_validate_ack`. The ack which was skipped still got written to qlog. The bug occurs in `ngtcp2_qlog::write_ack_frame`. It is now possible to reach this code with an invalid ack, suppose `largest_ack=0` and `first_ack_range=15`. Subtracting `largest_ack - first_ack_range` will lead to an integer underflow which is 20 chars long. However, the ngtcp2 qlog code assumes the number written is a signed integer and only accounts for 19 characters of overhead (see `NGTCP2_QLOG_ACK_FRAME_RANGE_OVERHEAD`). Therefore, we overwrite the buffer causing a heap overflow. This is high priority and could potentially impact many users if they enable qlog. qlog is disabled by default. Due to its overhead, it is most likely used for debugging purpose, but the actual use is unknown. ngtcp2 v1.9.1 fixes the bug and users are advised to upgrade. Users unable to upgrade should not turn on qlog.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0324 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-52811:
    A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY     notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be     terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption     and potential denial of service under certain conditions.

    This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.

    CVE-2025-23085:
    The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not     validated before being written to the qlog leading to a buffer overflow. In `ngtcp2_conn::conn_recv_pkt`     for an ACK, there was new logic that got added to skip `conn_recv_ack` if an ack has already been     processed in the payload. However, this causes us to also skip `ngtcp2_pkt_validate_ack`. The ack which     was skipped still got written to qlog. The bug occurs in `ngtcp2_qlog::write_ack_frame`. It is now     possible to reach this code with an invalid ack, suppose `largest_ack=0` and `first_ack_range=15`.
    Subtracting `largest_ack - first_ack_range` will lead to an integer underflow which is 20 chars long.
    However, the ngtcp2 qlog code assumes the number written is a signed integer and only accounts for 19     characters of overhead (see `NGTCP2_QLOG_ACK_FRAME_RANGE_OVERHEAD`). Therefore, we overwrite the buffer     causing a heap overflow. This is high priority and could potentially impact many users if they enable     qlog. qlog is disabled by default. Due to its overhead, it is most likely used for debugging purpose, but     the actual use is unknown. ngtcp2 v1.9.1 fixes the bug and users are advised to upgrade. Users unable to     upgrade should not turn on qlog.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not     validated before being written to the qlog leading to a buffer overflow. In `ngtcp2_conn::conn_recv_pkt`     for an ACK, there was new logic that got added to skip `conn_recv_ack` if an ack has already been     processed in the payload. However, this causes us to also skip `ngtcp2_pkt_validate_ack`. The ack which     was skipped still got written to qlog. The bug occurs in `ngtcp2_qlog::write_ack_frame`. It is now     possible to reach this code with an invalid ack, suppose `largest_ack=0` and `first_ack_range=15`.
    Subtracting `largest_ack - first_ack_range` will lead to an integer underflow which is 20 chars long.
    However, the ngtcp2 qlog code assumes the number written is a signed integer and only accounts for 19     characters of overhead (see `NGTCP2_QLOG_ACK_FRAME_RANGE_OVERHEAD`). Therefore, we overwrite the buffer     causing a heap overflow. This is high priority and could potentially impact many users if they enable     qlog. qlog is disabled by default. Due to its overhead, it is most likely used for debugging purpose, but     the actual use is unknown. ngtcp2 v1.9.1 fixes the bug and users are advised to upgrade. Users unable to     upgrade should not turn on qlog. (CVE-2024-52811)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0295 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-52811:
    The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not     validated before being written to the qlog leading to a buffer overflow. In `ngtcp2_conn::conn_recv_pkt`     for an ACK, there was new logic that got added to skip `conn_recv_ack` if an ack has already been     processed in the payload. However, this causes us to also skip `ngtcp2_pkt_validate_ack`. The ack which     was skipped still got written to qlog. The bug occurs in `ngtcp2_qlog::write_ack_frame`. It is now     possible to reach this code with an invalid ack, suppose `largest_ack=0` and `first_ack_range=15`.
    Subtracting `largest_ack - first_ack_range` will lead to an integer underflow which is 20 chars long.
    However, the ngtcp2 qlog code assumes the number written is a signed integer and only accounts for 19     characters of overhead (see `NGTCP2_QLOG_ACK_FRAME_RANGE_OVERHEAD`). Therefore, we overwrite the buffer     causing a heap overflow. This is high priority and could potentially impact many users if they enable     qlog. qlog is disabled by default. Due to its overhead, it is most likely used for debugging purpose, but     the actual use is unknown. ngtcp2 v1.9.1 fixes the bug and users are advised to upgrade. Users unable to     upgrade should not turn on qlog.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
275946	TencentOS Server 4: nodejs (TSSA-2025:0324)	Nessus	Tencent Local Security Checks	high
251580	Linux Distros Unpatched Vulnerability : CVE-2024-52811	Nessus	Misc.	high
239208	TencentOS Server 4: nodejs20 (TSSA-2025:0295)	Nessus	Tencent Local Security Checks	high

Detections

Analytics

CVE-2024-52811

high

Tenable Plugins

high

high

high