CVE-2026-40898: 
Prometheus vulnerability analysis and mitigation

CVE-2026-40898 is an HTTP/3 QPACK Trailer Expansion Memory Exhaustion vulnerability in the quic-go library, a Go implementation of the QUIC protocol. An unauthenticated attacker can trigger excessive memory allocation in both HTTP/3 server and client implementations by sending a specially crafted QPACK-encoded HEADERS frame containing large trailer field sections. All versions up to and including v0.59.0 are affected; the issue was patched in v0.59.1. The vulnerability was published by maintainer marten-seemann on May 31, 2026, and assigned a CVSS v3.1 base score of 5.3 (Medium) by the GitHub Advisory Database (Github Advisory, quic-go Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): quic-go enforced size limits on the QPACK-compressed HEADERS frame (via http3.Server.MaxHeaderBytes and http3.Transport.MaxResponseHeaderBytes, defaulting to 1 MB and 10 MB respectively) but did not enforce limits on the decoded field section size for HTTP trailers. A maliciously crafted HEADERS frame carrying trailers can expand to approximately 50x the encoded size by leveraging QPACK static table entries with long names and/or values. RFC 9114 mandates that endpoints enforce decoded field section size limits via SETTINGS, which quic-go failed to implement for trailers — unlike the similar CVE-2025-64702, which targeted HTTP headers rather than trailers. No authentication or user interaction is required; any network-reachable peer can trigger the condition (Github Advisory, quic-go Advisory).

Successful exploitation causes memory exhaustion on the target process, potentially leading to crashes or severe resource exhaustion on both HTTP/3 servers and clients using quic-go. Because the vulnerability is symmetric — affecting both server and client implementations — a malicious server can also exploit connecting clients, broadening the attack surface. There is no confidentiality or integrity impact; the sole consequence is availability loss (Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of writing. The EPSS score is approximately 0.058% (19th percentile), indicating a low near-term exploitation probability (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified. The low attack complexity and lack of authentication requirements make it straightforward to exploit if targeted, but the specialized nature of HTTP/3 deployments limits the exposed population.

1. Reconnaissance: Identify services using quic-go versions ≤ 0.59.0 for HTTP/3 (QUIC/UDP port 443 or custom ports). Tools like Shodan or active QUIC probing can help identify HTTP/3-capable endpoints.
2. Establish QUIC connection: Initiate a QUIC connection to the target HTTP/3 server (or act as a malicious server to target a connecting client).
3. Craft malicious HEADERS frame: Construct a QPACK-encoded HEADERS frame that, when decoded, produces a very large trailer field section — using many unique field names and/or large values, leveraging QPACK static table entries to achieve approximately 50x expansion relative to the compressed size, while keeping the compressed frame within the server's MaxHeaderBytes limit.
4. Send trailer frame: Transmit the crafted HEADERS frame as HTTP trailers at the end of a request or response body, bypassing the compressed-size check.
5. Trigger memory exhaustion: The server or client decodes the trailer without enforcing decoded field section size limits, allocating excessive memory and potentially causing a crash or resource exhaustion (Github Advisory, quic-go Advisory).

• Network: Unexpected or repeated QUIC connections (UDP) to HTTP/3 endpoints followed by abnormal stream termination; large HEADERS frames sent as trailers near the end of HTTP/3 streams.
• Process: Sudden spike in memory consumption of the Go process hosting quic-go's HTTP/3 server or client; out-of-memory (OOM) kills or process crashes in services using quic-go.
• Logs: Application-level errors or panics in Go runtime logs related to memory allocation failures; unexpected stream resets or connection closures in quic-go debug logs.

Upgrade quic-go to version v0.59.1 or later, which enforces RFC 9114 decoded field section size limits for trailers by incrementally decoding QPACK entries and aborting the stream if the decoded size limit is exceeded (quic-go Release, Github Advisory). No configuration-based workaround is available in unpatched versions, as the limit enforcement was absent at the code level. Organizations should prioritize upgrading any service — both HTTP/3 servers and clients — that depends on the quic-go library.