Hi,

The following vulnerability was published for golang-github-lucas-clemente-quic-go.

CVE-2026-40898[0]:
| quic-go is an implementation of the QUIC protocol in Go. Prior to
| version 0.59.1, an attacker can cause excessive memory allocation in
| quic-go's HTTP/3 client and server implementations by sending a
| QPACK-encoded HEADERS frame that decodes into a large trailer field
| section with many unique field names and/or large values. The
| implementation builds an `http.Header` for the corresponding
| `http.Request` or `http.Response`, while only enforcing limits on
| the size of the QPACK-compressed HEADERS frame, not on the decoded
| field section. This can lead to memory exhaustion. This is very
| similar to CVE-2025-64702. The difference is that this issue uses
| HTTP trailers, rather than HTTP headers, as the attack vector. A
| misbehaving or malicious peer can cause a denial-of-service (DoS)
| attack against quic-go's HTTP/3 servers or clients by triggering
| excessive memory allocation, potentially leading to crashes or
| resource exhaustion. This affects both servers and clients due to
| symmetric header construction. Version 0.59.1 enforces RFC 9114
| decoded field section size limits for trailers as well. It
| incrementally decodes QPACK entries and checks the field section
| size after each entry, aborting the stream if an entry causes the
| limit to be exceeded.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-40898
https://www.cve.org/CVERecord?id=CVE-2026-40898
[1] https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
golang-github-lucas-clemente-quic-go, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1139169@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Simon Josefsson <simon@josefsson.org> (supplier of updated golang-github-lucas-clemente-quic-go package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 21 Oct 2026 09:29:12 +0200
Source: golang-github-lucas-clemente-quic-go
Architecture: source
Version: 0.64.1-1
Distribution: experimental
Urgency: medium
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed-By: Simon Josefsson <simon@josefsson.org>
Closes: 1072180 1139169
Changes:
 golang-github-lucas-clemente-quic-go (0.64.1-1) experimental; urgency=medium
 .
   * Team upload
   * New upstream release
     - CVE-2026-40898 (Closes: 1139169)
     - CVE-2024-22189 already fixed before (Closes: 1072180)
   * Use Standards-Version: 4.7.4
   * Use dh-sequence-golang
   * Use watch v5
   * Use gbp sign-tags
   * Use gbp upstream-vcs-tag
   * Run wrap-and-sort -satbk
   * Modernize Salsa CI
   * Bump compat to 14
   * Bump debian/* copyright years
   * Work around unpackaged github.com/quic-go/go-ossfuzz-seeds
   * Re-initialize list of flaky tests to skip
   * Compat 14 fix d/links
   * Drop d/gitlab-ci.yml
   * Compat 14 fix of *.install
   * Use gbp debian-branch debian/experimental
Checksums-Sha1:
 e42bd74352dec7bad56f098a170f034a2a6cec79 3063 golang-github-lucas-clemente-quic-go_0.64.1-1.dsc
 ac89164d8b1cfca78643866c5b0c2d1ebc9e48e7 588404 golang-github-lucas-clemente-quic-go_0.64.1.orig.tar.xz
 d7e2ac8cdc72a282ba16216978cfa260bf79b815 7428 golang-github-lucas-clemente-quic-go_0.64.1-1.debian.tar.xz
 04450449ae224a6fdb069e7cb8334b69310cc6a4 1708656 golang-github-lucas-clemente-quic-go_0.64.1-1.git.tar.xz
 424331ad00eb103281269cd03d5c340f7ac9476a 17844 golang-github-lucas-clemente-quic-go_0.64.1-1_source.buildinfo
Checksums-Sha256:
 054bbbdaf0c230c665a42bc2de0b9f345d888fa8485869813a625e8d07498b3d 3063 golang-github-lucas-clemente-quic-go_0.64.1-1.dsc
 80070941b1703b99b7fcad31353a7bf6f6c93df42d65120028e7d45be9231390 588404 golang-github-lucas-clemente-quic-go_0.64.1.orig.tar.xz
 2d9c0c4267321a397658cd8e8255019d35118adb14c503c4ebc5ad1eccb75fe2 7428 golang-github-lucas-clemente-quic-go_0.64.1-1.debian.tar.xz
 91b5ffba09087682ceead6714b495f317c9527a3c86c4f59b8429ed485c0e57b 1708656 golang-github-lucas-clemente-quic-go_0.64.1-1.git.tar.xz
 3dd89e4151dbc238070358415210d9aa686cf01e16a59ca9501176a3df0b5ed9 17844 golang-github-lucas-clemente-quic-go_0.64.1-1_source.buildinfo
Files:
 4c0c64d53d5aaecf7816278f85444051 3063 golang optional golang-github-lucas-clemente-quic-go_0.64.1-1.dsc
 99fd6bc38864fcd2d62bf0541b1123a7 588404 golang optional golang-github-lucas-clemente-quic-go_0.64.1.orig.tar.xz
 5a3ab61840d6b5a628dd744872801d4d 7428 golang optional golang-github-lucas-clemente-quic-go_0.64.1-1.debian.tar.xz
 36b57ee39008e58d00805a9a6baf9f90 1708656 golang None golang-github-lucas-clemente-quic-go_0.64.1-1.git.tar.xz
 63ef1b56adc58aa1cc294fe364686455 17844 golang optional golang-github-lucas-clemente-quic-go_0.64.1-1_source.buildinfo
Git-Tag-Info: tag=7cd7fadf826d2b0ecaf8347fead577a80958b81f fp=a3cc9c870b9d310abad4cf2f51722b08fe4745a2
Git-Tag-Tagger: Simon Josefsson <simon@josefsson.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrYc5EACgkQYG0ITkaD
wHnSJA/8CAUNiVYh5P9NzDMR0OZDCkLGmjNpJMHMo6M57LCISNjkoMQr63v0+oII
7rt/psHrQdk/D/eKKn3u9XduRvrqXIn/f6YVzQtAmt/xh10COoA6nsdLwmY+ubQB
5TotQfKSMcEnwLJ7BSEhfvoJ8HjGULjUosMonceBJewvAX0AATNk0uebNxxacoYc
pcVzMBhmG6vz/TEai4ciSz9Zi2qRPxbuk/xwY8ViAGUFbEqLcaQxorVdn/1F7FUE
fELjrDtOJToidan2va7R8FXko5IzlYanQ7Yfc1NfC8LZ04ozE/8+nYAm86MrIqxs
FK+aHZznCtl1HCIX2mxCigs8i9g6rQuFYq6irpjhQESG5Z7pbRpFQCfkjoGSsVU1
j+8Xo2mZZLu3ypZFknNFxMyeZ37ECMxbTvfX575XOihnXeyJxxBkWL95RWIUooz2
jQsQpmRzdvWDRcmfK3mdpCtnuGumfj27pv8pgropNzGzbU0ClL3op0bI/XnrsSJp
73KfYs141nweCJqOw+zU0g3jQgJv11fWn8EngjxO0ff052lWDkgXBlrAo5m98Zq0
M376mgJhDk/jThMfy9HaakTNMv+QMPq/AqVTkWw4cDNgus3ZTuKFR6zjgTevHzAB
Qe++tH4JGgd+auk7ZrDDa9lslwe9RGfNn9FJ1jmCYdrBMsaarmQ=
=C8ag
-----END PGP SIGNATURE-----