Threats affecting pkg:github/picoquic

An integer overflow vulnerability exists in picoquic versions before 2026.11.05.3e2e3d3 in the picoquic_decode_time_stamp_frame() function. This flaw allows remote QUIC peers to send oversized TIME_STAMP values that corrupt stored timestamps. The corruption affects round-trip time (RTT) and bandwidth estimation, degrading congestion control on affected connections.