Version in base suite: 0.12.1+dfsg-1 Base version: ngtcp2_0.12.1+dfsg-1 Target version: ngtcp2_0.12.1+dfsg-1+deb12u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/n/ngtcp2/ngtcp2_0.12.1+dfsg-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/n/ngtcp2/ngtcp2_0.12.1+dfsg-1+deb12u1.dsc changelog | 6 ++++++ patches/CVE-2026-40170.patch | 27 +++++++++++++++++++++++++++ patches/series | 1 + 3 files changed, 34 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpiolsvkxj/ngtcp2_0.12.1+dfsg-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpiolsvkxj/ngtcp2_0.12.1+dfsg-1+deb12u1.dsc: no acceptable signature found diff -Nru ngtcp2-0.12.1+dfsg/debian/changelog ngtcp2-0.12.1+dfsg/debian/changelog --- ngtcp2-0.12.1+dfsg/debian/changelog 2023-01-06 20:07:55.000000000 +0000 +++ ngtcp2-0.12.1+dfsg/debian/changelog 2026-04-20 02:31:58.000000000 +0000 @@ -1,3 +1,9 @@ +ngtcp2 (0.12.1+dfsg-1+deb12u1) bookworm-security; urgency=medium + + * Backport patch for CVE-2026-40170 (closes: #1134197) + + -- Samuel Henrique Sun, 19 Apr 2026 19:31:58 -0700 + ngtcp2 (0.12.1+dfsg-1) sid; urgency=medium * Uploading to sid. diff -Nru ngtcp2-0.12.1+dfsg/debian/patches/CVE-2026-40170.patch ngtcp2-0.12.1+dfsg/debian/patches/CVE-2026-40170.patch --- ngtcp2-0.12.1+dfsg/debian/patches/CVE-2026-40170.patch 1970-01-01 00:00:00.000000000 +0000 +++ ngtcp2-0.12.1+dfsg/debian/patches/CVE-2026-40170.patch 2026-04-20 02:31:58.000000000 +0000 @@ -0,0 +1,27 @@ +From 708a7640c1f48fb8ffb540c4b8ea5b4c1dfb8ee5 Mon Sep 17 00:00:00 2001 +From: Tatsuhiro Tsujikawa +Date: Fri, 10 Apr 2026 00:07:34 +0900 +Subject: [PATCH] Fix qlog parameters_set stack buffer overflow + +Backported-by: Samuel Henrique +Changes: +* Update offset +* Update patch context + +--- + lib/ngtcp2_qlog.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/ngtcp2_qlog.c b/lib/ngtcp2_qlog.c +index c83f885..4f5f378 100644 +--- a/lib/ngtcp2_qlog.c ++++ b/lib/ngtcp2_qlog.c +@@ -927,7 +927,7 @@ void ngtcp2_qlog_pkt_sent_end(ngtcp2_qlog *qlog, const ngtcp2_pkt_hd *hd, + void ngtcp2_qlog_parameters_set_transport_params( + ngtcp2_qlog *qlog, const ngtcp2_transport_params *params, int server, + ngtcp2_qlog_side side) { +- uint8_t buf[1024]; ++ uint8_t buf[2048]; + uint8_t *p = buf; + const ngtcp2_preferred_addr *paddr; + const ngtcp2_sockaddr_in *sa_in; diff -Nru ngtcp2-0.12.1+dfsg/debian/patches/series ngtcp2-0.12.1+dfsg/debian/patches/series --- ngtcp2-0.12.1+dfsg/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ ngtcp2-0.12.1+dfsg/debian/patches/series 2026-04-20 02:31:58.000000000 +0000 @@ -0,0 +1 @@ +CVE-2026-40170.patch