Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers
Alibaba's QUIC and HTTP/3 library, XQUIC, has a single incorrect variable on one line that allows any remote client to crash the server with a brief burst of perfectly legitimate data. No patch is present.
On July 8, FoxIO researcher Sébastien Féry revealed the vulnerability, which he termed XRING. According to him, the server process is brought down by roughly 260 bytes of regular QPACK traffic, therefore neither a login nor faulty packets are required.
Since XQUIC is open-source, any server that embeds it and uses the default QPACK settings to serve HTTP/3 is at danger, not just Alibaba. This includes Alibaba's Nginx-based web server, Tengine, which FoxIO claims fronts the company's cloud and CDN on websites like Taobao and Alipay.
It affects all releases up to the most recent ...