Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-07-10 11:47 UTC
Importiert: 2026-07-16 13:15 UTC
Quelle-ID: thn_global
uid_hash: c5f44796045d673366ecc450a9f5d64e139be38954ce4bc6f3828cc3d81776da

The Hacker News

Inhalt

A single wrong variable on one line in XQUIC, Alibaba's QUIC and HTTP/3 library, lets any remote client crash the server with a short burst of completely legal traffic. There is no patch.

FoxIO researcher Sébastien Féry disclosed the flaw on July 8 and nicknamed it XRING. He says it needs no login and no malformed packets: about 260 bytes of ordinary QPACK traffic takes the server

No data

Quellen-Details

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
The Hacker News	thn_global	security_news		-	de	https://feeds.feedburner.com/TheHackersNews

Zurueck zur Eintrags-Liste