CVE-2026-40208

LowCVSS 3.7/10Last modified Jun 25, 2026

Description

An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-705

Affected software

No affected versions have been published.

Timeline

Published
Jun 25, 2026
Last modified
Jun 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-402095.3An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediatCVE-2026-40218.1The Contest Gallery plugin for WordPress is vulnerable to an authentication bypass leading to admin account takeover in all versions up to, CVE-2026-402104.8An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network CVE-2026-402115.3An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The bufCVE-2026-402125.4OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting (XSS) vulnerability in the console because document.wrCVE-2026-402137.4OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorCVE-2026-402146.3In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column CVE-2026-402157.4A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash orCVE-2026-402178.8LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.CVE-2026-40226.4The Show Posts list – Easy designs, filters and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_type' sCVE-2026-402235.5In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.CVE-2026-402247.3In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace.
CVE-2026-40208: Low severity, CVSS 3.7 | Vulnix