See how picoquic compares to other vendors in security performance
picoquic before 2026.11.05.3e2e3d3 contains an integer overflow vulnerability in picoquicdecodetimestampframe() that allows remote QUIC peers to corrupt stored timestamps by sending oversized TIMESTAMP values. Attackers on connections negotiating the TIMESTAMP extension can send large values shifted by ackdelayexponent to wrap the result, corrupting RTT and bandwidth estimation and degrading congestion control.
The hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs).