quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or large values. The implementation builds an `http.Header` for the corresponding `http.Request` or `http.Response`, while only enforcing limits on the size of the QPACK-compressed HEADERS frame, not on the decoded field section. This can lead to memory exhaustion. This is very similar to CVE-2025-64702. The difference is that this issue uses HTTP trailers, rather than HTTP headers, as the attack vector. A misbehaving or malicious peer can cause a denial-of-service (DoS) attack against quic-go's HTTP/3 servers or clients by triggering excessive memory allocation, potentially leading to crashes or resource exhaustion. This affects both servers and clients due to symmetric header construction. Version 0.59.1 enforces RFC 9114 decoded field section size limits for trailers as well. It incrementally decodes QPACK entries and checks the field section size after each entry, aborting the stream if an entry causes the limit to be exceeded.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause     excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-     encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or     large values. The implementation builds an `http.Header` for the corresponding `http.Request` or     `http.Response`, while only enforcing limits on the size of the QPACK-compressed HEADERS frame, not on the     decoded field section. This can lead to memory exhaustion. This is very similar to CVE-2025-64702. The     difference is that this issue uses HTTP trailers, rather than HTTP headers, as the attack vector. A     misbehaving or malicious peer can cause a denial-of-service (DoS) attack against quic-go's HTTP/3 servers     or clients by triggering excessive memory allocation, potentially leading to crashes or resource     exhaustion. This affects both servers and clients due to symmetric header construction. Version 0.59.1     enforces RFC 9114 decoded field section size limits for trailers as well. It incrementally decodes QPACK     entries and checks the field section size after each entry, aborting the stream if an entry causes the     limit to be exceeded. (CVE-2026-40898)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause
    excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-
    encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or
    large values. The implementation builds an `http.Header` for the corresponding `http.Request` or
    `http.Response`, while only enforcing limits on the size of the QPACK-compressed HEADERS frame, not on the
    decoded field section. This can lead to memory exhaustion. This is very similar to CVE-2025-64702. The
    difference is that this issue uses HTTP trailers, rather than HTTP headers, as the attack vector. A
    misbehaving or malicious peer can cause a denial-of-service (DoS) attack against quic-go's HTTP/3 servers
    or clients by triggering excessive memory allocation, potentially leading to crashes or resource
    exhaustion. This affects both servers and clients due to symmetric header construction. Version 0.59.1
    enforces RFC 9114 decoded field section size limits for trailers as well. It incrementally decodes QPACK
    entries and checks the field section size after each entry, aborting the stream if an entry causes the
    limit to be exceeded. (CVE-2026-40898)

ID	Name	Product	Family	Severity
318811	Linux Distros Unpatched Vulnerability : CVE-2026-40898	Nessus	Misc.	high
442605	SCA: security update for github.com/quic-go/quic-go (GHSA-vvgj-x9jq-8cj9)	Tenable Cloud Security	SCA Checks	high
442605	SCA: security update for github.com/quic-go/quic-go (GHSA-vvgj-x9jq-8cj9)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-40898

high

Tenable Plugins

high

high

high