XQUIC XRING Vulnerability Lets Remote Clients Crash Alibaba's QUIC Library with Legal Traffic
Avoid using XQUIC or apply a workaround to prevent remote crash via XRING until a patch is released.
Disable or replace XQUIC in your infrastructure, or implement a traffic filter to block 260-byte QPACK bursts.
Summary
A single wrong variable in XQUIC, Alibaba's QUIC and HTTP/3 library, allows any remote client to crash the server with a short burst of legal QPACK traffic. The flaw, dubbed XRING, requires no authentication or malformed packets; about 260 bytes of ordinary QPACK traffic can trigger a server crash. FoxIO researcher Sébastien Féry disclosed XRING on July 8, and there is currently no patch available. The vulnerability affects all deployments of XQUIC and can lead to denial‑of‑service attacks on HTTP/3 servers. The flaw exploits a buffer overflow in the QPACK decoder, causing the server to terminate unexpectedly. Attackers can trigger the crash from any client, making it a low‑effort DoS vector. Security teams should avoid using XQUIC until a patch is released or implement traffic filtering to block the offending packets. The incident underscores the need for rigorous testing of QUIC implementations.
Key changes
- A wrong variable in XQUIC causes a crash with 260 bytes of legal QPACK traffic
- The flaw, XRING, requires no authentication or malformed packets
- Disclosed July 8 by FoxIO researcher Sébastien Féry
- No patch is available yet; all XQUIC deployments are affected
- The vulnerability can be used to launch DoS attacks on HTTP/3 servers
- Attackers can trigger the crash from any client with a simple packet burst