Utopia Tech
Security1 min read

Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers

A single wrong variable on one line in XQUIC, Alibaba's QUIC and HTTP/3 library, lets any remote client crash the server with a short burst of completely legal traffic. There is no patch. FoxIO researcher Sébastien Féry disclosed the flaw on July 8 and nicknamed it XRING. He says it needs no login and no malformed packets: about 260 bytes of ordinary QPACK traffic takes the ser

UT

Utopia Tech

July 10, 2026 · 1 min read

Share

A single wrong variable on one line in XQUIC, Alibaba's QUIC and HTTP/3 library, lets any remote client crash the server with a short burst of completely legal traffic. There is no patch. FoxIO researcher Sébastien Féry disclosed the flaw on July 8 and nicknamed it XRING. He says it needs no login and no malformed packets: about 260 bytes of ordinary QPACK traffic takes the server

Originally published at thehackernews.com

#Cybersecurity#Malware#Vulnerabilities
Share
▸ Want a deeper look?

Talk to an architect about applying this to your stack.

60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.

Schedule the call
▸ Continue reading

More from the journal

URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat
Security

URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat

1 min read

Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Run Code at Boot
Security

Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Run Code at Boot

1 min read

Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages
Security

Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages

1 min read

All posts
Skip to main content