Unpatched XRING Flaw in Alibaba’s XQUIC Lets Remote Clients Crash HTTP/3 Servers

A critical unpatched vulnerability, dubbed XRING, has been disclosed in XQUIC, Alibaba’s open-source QUIC and HTTP/3 library. Discovered by FoxIO researcher Sébastien Féry, the flaw allows any remote client to crash an HTTP/3 server using approximately 260 bytes of legitimate QPACK traffic, without requiring authentication or malformed packets.

The vulnerability resides in XQUIC’s handling of QPACK header compression. When a client requests to resize the dynamic table, XQUIC’s ring buffer copy logic miscalculates the amount of data to move. In one specific case, the code uses the new buffer’s capacity instead of the old one’s, leading to an integer underflow. This causes a memory copy operation to read or write far beyond allocated bounds, resulting in a server crash. FoxIO demonstrated the crash on Ubuntu 26.04 with glibc’s _FORTIFY_SOURCE=2, which caught the overflow and terminated the process. Without such protections, the flaw could potentially lead to out-of-bounds writes.

All XQUIC releases through v1.9.4 are affected. The library is used in Alibaba’s Tengine web server, which powers the company’s cloud and CDN services, including Taobao and Alipay. No patch or CVE has been issued as of July 10, 2026. FoxIO reported the issue to Alibaba on April 7, 2026, following the project’s security policy, but received no response after five follow-ups through May 9. As a temporary mitigation, operators can set SETTINGS_QPACK_MAX_TABLE_CAPACITY to 0 to disable QPACK’s dynamic table, or remove HTTP/3 support entirely.

XRING is the latest in a series of remote crash vulnerabilities in HTTP/2 and HTTP/3 stacks, following similar issues in NGINX (CVE-2026-42530), Calif’s HTTP/2 Bomb, and HAProxy. FoxIO has not confirmed exploitation in the wild or whether the heap write can be escalated beyond a crash.