Rescana XRING Vulnerability in XQUIC Threatens HTTP/3 Servers with Remote Crash Risk
Article Content
- •The XRING vulnerability in XQUIC allows remote clients to crash HTTP/3 servers.
- •No patch or CVE has been assigned as of July 10, 2026, despite the public disclosure.
- •The flaw has existed since January 2022 and affects all XQUIC versions up to v1.9.4.
A critical unpatched vulnerability, XRING, has been identified in the XQUIC library, affecting HTTP/3 servers. This flaw allows any remote, unauthenticated client to crash servers using XQUIC with as little as 260 bytes of legal QPACK traffic. All releases of XQUIC up to v1.9.4 are impacted, including Alibaba's Tengine, which is used by major platforms like Taobao and Alipay. The vulnerability stems from a memory corruption issue in the QPACK dynamic table implementation, leading to potential denial-of-service attacks. As of July 10, 2026, there is no patch or CVE assigned, and while a public proof-of-concept (PoC) exists, there are no confirmed reports of exploitation in the wild. The CISA Known Exploited Vulnerabilities catalog does not list this issue, indicating no confirmed active exploitation. The vulnerability has existed since January 2022 and poses a significant risk to organizations relying on HTTP/3 infrastructure.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track Alibaba Cloud and CVE-2026-42530 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active… 
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…