negativeSYS.SOURCE: The Hacker News• 2026-07-10T17:17:43+05:30

Unpatched XRING Vulnerability in XQUIC Enables Remote HTTP/3 Server Crashes

#http/3 #xquic #server security #denial of service #open source

An unpatched vulnerability in XQUIC's QPACK implementation allows remote clients to crash HTTP/3 servers using standard traffic, affecting systems like Tengine. No official patch or CVE has been released, with mitigations requiring configuration changes or disabling HTTP/3.

A single wrong variable on one line in XQUIC, Alibaba's QUIC and HTTP/3 library, lets any remote client crash the server with a short burst of completely legal traffic. There is no patch.

FoxIO researcher Sébastien Féry disclosed the flaw on July 8 and nicknamed it XRING. He says it needs no login and no malformed packets: about 260 bytes of ordinary QPACK traffic takes the server

Read original article

*** END OF TRANSMISSION ***

> U.S. TREASURY BOND MARKET VOLATILITY AND EROSION OF SAFE-HAVEN STATUS > HACKER NEWS DISCUSSION ON SIDE PROJECTS EARNING $500/MONTH IN 2026 > UK EVISA SYSTEM ERROR CAUSES TWIN SISTER IDENTITY MIX-UP, STRANDING WOMAN IN SPAIN > THE EVOLUTION OF SOCIETAL NORMS AND THE RISING VALUE OF UNCONVENTIONAL THINKING > EFFICIENT DRILLDOWN DASHBOARDS USING SINGLE PARQUET FILE AND HYPARQUET > UAT-10147 LEVERAGES AI AND SPECTRE FOR SCALABLE SERVER ATTACKS AND LINUX ROOTKIT DEPLOYMENT > OVER 5,200 EBOLA CASES REPORTED IN DRC AFTER 100 DAYS OF OUTBREAK > ANDREESSEN HOROWITZ'S CONTROVERSIAL AI INVESTMENTS AND POLICY INFLUENCE > FDA APPROVES BLOOD TEST FOR ALZHEIMER'S DISEASE BIOMARKER DETECTION > CHROME EXTENSION FOR OFFLINE OCR OF PAGINATED DOCUMENTS> U.S. TREASURY BOND MARKET VOLATILITY AND EROSION OF SAFE-HAVEN STATUS > HACKER NEWS DISCUSSION ON SIDE PROJECTS EARNING $500/MONTH IN 2026 > UK EVISA SYSTEM ERROR CAUSES TWIN SISTER IDENTITY MIX-UP, STRANDING WOMAN IN SPAIN > THE EVOLUTION OF SOCIETAL NORMS AND THE RISING VALUE OF UNCONVENTIONAL THINKING > EFFICIENT DRILLDOWN DASHBOARDS USING SINGLE PARQUET FILE AND HYPARQUET > UAT-10147 LEVERAGES AI AND SPECTRE FOR SCALABLE SERVER ATTACKS AND LINUX ROOTKIT DEPLOYMENT > OVER 5,200 EBOLA CASES REPORTED IN DRC AFTER 100 DAYS OF OUTBREAK > ANDREESSEN HOROWITZ'S CONTROVERSIAL AI INVESTMENTS AND POLICY INFLUENCE > FDA APPROVES BLOOD TEST FOR ALZHEIMER'S DISEASE BIOMARKER DETECTION > CHROME EXTENSION FOR OFFLINE OCR OF PAGINATED DOCUMENTS