On point: An unpatched denial-of-service vulnerability in Alibaba’s XQUIC library enables HTTP/3 server crashes through simple, protocol-compliant QPACK requests; Alibaba has not responded since April 2026.
A previously unpatched security vulnerability in Alibaba’s XQUIC library (v1.9.4 and earlier) allows remote clients to crash HTTP/3 servers with a minimal 260 bytes of regular QPACK traffic. Affected web servers include Tengine, which is deployed in CDNs and cloud infrastructure of major Chinese platforms such as Taobao and Alipay.
Security researcher Sébastien Féry from FoxIO identified an integer underflow in XQUIC’s header compression logic. When a client requests an expansion of the dynamic QPACK table, a new buffer is allocated and existing data is copied. The incorrectly implemented code calculates the remaining data based on the capacity of the new, larger buffer instead of the old buffer. This leads to an underflow of the unsigned integer type size_t with an extremely large resulting copy length.
The resulting out-of-bounds write access is detected by protection mechanisms such as glibc-Fortify in current Linux distributions and triggers immediate server process termination. Particularly critical: the attack uses exclusively regular, protocol-compliant QPACK values. Malformed packets are not required, which is why conventional security filters do not respond. The vulnerability has existed since the library’s initial publication in January 2022, and a proof-of-concept is publicly available.
FoxIO notified Alibaba of the vulnerability on 7 April 2026 in accordance with project guidelines. Despite multiple follow-ups, Alibaba remained unresponsive until publication in July 2026. Neither a security patch nor a CVE number has been published to date. As interim solutions, the researchers recommend setting the QPACK parameter SETTINGS_QPACK_MAX_TABLE_CAPACITY to 0 to disable the dynamic table, or disabling HTTP/3 entirely on affected servers.
Source: www.it-daily.net · Published 15 July 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.