Unpatched XRING Flaw in XQUIC Lets Attackers Crash HTTP/3 Servers

A critical unpatched vulnerability in XQUIC—Alibaba's open-source QUIC and HTTP/3 library—allows any remote client to crash servers with a tiny burst of legitimate traffic. Dubbed "XRING" by FoxIO researcher Sébastien Féry, who disclosed it on July 8, the flaw requires no authentication and no malformed packets: approximately 260 bytes of standard QPACK header compression traffic is enough to terminate the server process. XQUIC powers Alibaba's Tengine web server, which fronts the company's cloud and CDN infrastructure on properties including Taobao and Alipay, but since the library is open source, any HTTP/3 deployment embedding it is exposed.

The bug lives in XQUIC's QPACK implementation, the header compression mechanism HTTP/3 uses to avoid resending repeated headers like user-agent strings. XQUIC stores the dynamic compression table in a ring buffer; when a client requests a table resize, the library allocates a larger buffer and copies data across. In one of four wrap-around cases, the code miscalculates the remaining tail bytes by sizing leftover data against the new buffer's capacity instead of the old one. A resize from 64 bytes to 65 bytes with the write cursor near the end triggers an overcount—XQUIC computes 70 tail bytes when only 6 exist. That erroneous value flows into a memcpy where subtracting the overcount from a smaller unsigned size_t value causes an underflow to a near-maximum integer, sending the copy past the end of allocated memory.

Every XQUIC release through v1.9.4 is vulnerable, including builds dating back to the library's January 2022 debut. No CVE has been assigned and no fix is available as of July 10, and a proof-of-concept exploit is publicly available on FoxIO's GitHub. While Féry demonstrated the crash on Ubuntu 26.04 where glibc's _FORTIFY_SOURCE=2 mitigation intercepted the overflow, he did not test whether the corruption could enable further exploitation. Operators managing HTTP/3 endpoints can audit exposure using our port scanner to verify QUIC/UDP 443 availability, while our SSL/TLS checker can help identify misconfigured transport-layer stacks.

Until XQUIC maintainers ship a patch, administrators should set SETTINGS_QPACK_MAX_TABLE_CAPACITY to 0 to disable QPACK's dynamic table, or disable HTTP/3 entirely. The flaw joins a recent cluster of remote crash vulnerabilities in HTTP/2 and HTTP/3 stacks, including a use-after-free in NGINX's HTTP/3 module (CVE-2026-42530) disclosed three weeks earlier, underscoring ongoing fragility in next-generation web transport implementations. Security teams should monitor vendor advisories closely and run a full privacy checkup on any HTTP/3-enabled services to inventory attack surface and validate compensating controls.