Skip to content
Threat Feed
Subscribe

Tag

Quic

3 briefs RSS
critical advisory

Improper Certificate Validation in MsQuic OpenSSL Backend

The MsQuic library using OpenSSL or QuicTLS backends fails to perform proper TLS hostname verification, enabling on-path attackers to perform man-in-the-middle (MITM) attacks and spoof server identities.

MsQuic vulnerability tls quic mitm
1t 1c
medium advisory

CVE-2026-40898: quic-go HTTP/3 Memory Exhaustion DoS

A vulnerability in quic-go, an implementation of the QUIC protocol in Go, allows a remote attacker to cause a denial-of-service (DoS) condition by sending specially crafted QPACK-encoded HEADERS frames with large trailer field sections, leading to excessive memory allocation in affected HTTP/3 client and server implementations prior to version 0.59.1.

PoC quic-go denial-of-service vulnerability network http3 quic golang
1t 2c updated
medium advisory

Hysteria Server Out-of-Memory Vulnerability via Malformed QUIC Packet

A specially constructed QUIC package can crash the Hysteria server due to an out-of-memory (OOM) condition when the 'sniff' option is enabled, leading to a denial of service.

hysteria/core/v2 hysteria quic oom dos
2r 1t