An unpatched denial-of-service vulnerability in Alibaba’s XQUIC library enables HTTP/3 server crashes through simple, protocol-compliant QPACK requests; Alibaba has not responded since April 2026.