CVE-2026-55991: Ngtcp2 Invalid Application Error Code
Passing `-1` as an application error code to `ngtcp2_ccerr_set_application_error` or `ngtcp2_connection_close_error_set_application_error` causes an implicit cast to `UINT64_MAX`. This exceeds the maximum value for a QUIC variable-length integer (62 bits) and will cause an assertion failure in libngtcp2 during serialization. Pass a valid application error co
Cgreprules fetch cve-2026-55991-ngtcp2-invalid-application-error-code --engine opengrepDescription
Passing `-1` as an application error code to `ngtcp2_ccerr_set_application_error` or `ngtcp2_connection_close_error_set_application_error` causes an implicit cast to `UINT64_MAX`. This exceeds the maximum value for a QUIC variable-length integer (62 bits) and will cause an assertion failure in libngtcp2 during serialization. Pass a valid application error co
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.