PICOQUIC · CVE-2026-129135 · Package
NO FIX YET · SEE WHAT TO DO
picoquic, a QUIC library, has an integer overflow in its TIME_STAMP frame decoder. A remote QUIC peer can send oversized values that wrap around, corrupting stored timestamps, RTT and bandwidth estimates and degrading congestion control.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that embed the picoquic QUIC library and accept connections from remote peers that negotiate the TIME_STAMP extension. The sources describe a performance and congestion-control impact rather than code execution. Applications not using picoquic, or not negotiating TIME_STAMP, can skip it.
Not affected if not-using-picoquic, time-stamp-extension-not-negotiated
Who cares c, picoquic, quic
2026.11.05.3e2e3d3 are affected.2026.11.05.3e2e3d3 or later.picoquic before 2026.11.05.3e2e3d3 contains an integer overflow vulnerability in picoquic_decode_time_stamp_frame() that allows remote QUIC peers to corrupt stored timestamps by sending oversized TIME_STAMP values. Attackers on connections negotiating the TIME_STAMP extension can send large values shifted by ack_delay_exponent to wrap the result, corrupting RTT and bandwidth estimation and degrading congestion control.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.