Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers

A Critical Flaw in XQUIC: XRING Vulnerability

The recent discovery of the XRING vulnerability in XQUIC, Alibaba's QUIC and HTTP/3 library, has sent shockwaves through the security community. This flaw allows remote clients to crash HTTP/3 servers with a short burst of legal traffic, affecting all releases through v1.9.4. The lack of a patch and a CVE number has raised concerns about the security of HTTP/3 and QUIC implementations.

How XRING Works

The XRING vulnerability exploits a flaw in how HTTP/3 compresses headers. To avoid sending the same header over and over, HTTP/3 uses QPACK, which keeps a shared table that the client directs the server to build up and resize through a dedicated control channel, the encoder stream. XQUIC stores that table's bytes in a ring buffer, a fixed block of memory where data wraps from the end back to the start once it fills. When the client asks to grow the table, XQUIC allocates a bigger buffer and copies the old data across. However, in one of the four cases, the code sizes the leftover tail data against the new, larger buffer's capacity instead of the old one's, leading to an underflow and a memory copy that runs off the end of memory.

The Impact of XRING

The XRING vulnerability has significant implications for the security of HTTP/3 and QUIC implementations. It highlights the importance of security in these protocols and the need for regular testing and patching. The lack of a patch and a CVE number has raised concerns about the security of servers that embed XQUIC and serve HTTP/3 with the default QPACK settings. Until a fix ships, operators can set SETTINGS_QPACK_MAX_TABLE_CAPACITY to 0, which turns off QPACK's dynamic table, or drop HTTP/3 support entirely.

A History of Remote Crashes in HTTP/2 and HTTP/3 Stacks

The XRING vulnerability is the latest in a string of remote crashes in HTTP/2 and HTTP/3 stacks. Three weeks earlier, THN reported a use-after-free in NGINX's HTTP/3 module (CVE-2026-42530) that a remote, unauthenticated client could reach through the same QPACK encoder stream XRING abuses, a different bug class on the same attack surface. In June, Calif's HTTP/2 Bomb caused remote denial of service against Nginx, Apache, IIS, and Envoy by abusing HPACK, HTTP/2's header compression, and the predecessor to QPACK. In February, HAProxy patched two QUIC crashes, one an integer underflow during token validation, the same type of bug behind XRING, though it needed a malformed packet where XRING needs none.