An Unpatchable XRING Vulnerability Found in Alibaba's XQUIC Library

Sebastian Fery, a researcher at FoxIO, has disclosed a vulnerability in the XQUIC library — an implementation of the QUIC and HTTP/3 protocols developed by Alibaba. The issue has been named XRING.

According to the researcher, the vulnerability stems from a single incorrectly specified variable in one line of code. This allows any remote client to crash the server by sending a short burst of fully legitimate traffic — with no authentication required and without using deliberately malformed packets.

As described, exploitation takes only about 260 bytes of ordinary QPACK traffic to bring the server down. QPACK is the header compression mechanism used in HTTP/3.

Information about the flaw was disclosed on July 8. At the time of publication, no fix for the vulnerability is available.

Because XQUIC is used in Alibaba's infrastructure and potentially in other projects that rely on the library, the absence of a patch poses a risk to servers handling HTTP/3 connections. The ease of exploitation — the minimal amount of traffic and the lack of any need for specially crafted packets — makes the vulnerability especially dangerous to service availability.

The technical details of how the attack works, as well as the timeline for a fix, have not yet been disclosed.

Source: The Hacker News