Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers
Summary: FoxIO researcher Sébastien Féry disclosed on July 8 an unpatched flaw in XQUIC, Alibaba's open-source QUIC and HTTP/3 library, that lets any remote client crash the server with about 260 bytes of ordinary QPACK traffic and no login or malformed packets. The bug, nicknamed XRING, has been present since XQUIC's first public release in January 2022 and affects every release through v1.9.4, with no fixed release and no CVE as of July 10.
Bottom line: FoxIO says it emailed Alibaba on April 7 through the project's security policy, which promises a reply within three working days, and followed up four more times through May 9 without an answer before going public - so any server embedding XQUIC with default QPACK settings, including Tengine deployments fronting Taobao and Alipay, is exposed with no patch to apply.
Read the original at The Hacker News ↗
- Mentions
- CVE-2026-42530
- Related