CVE-2026-42530

🛡️ CVE-2026-42530 - NGINX HTTP/3 QUIC Use-After-Free Vulnerability High-Severity Use-After-Free in NGINX HTTP/3 QUIC ⚠️ QPACK Encoder Stream Vulnerability 🔍 Overview CVE-2026-42530 is a use-after-free vulnerability in NGINX's ngxhttpv3module. A remote unauthenticated attacker can trigger it by...

ssh3

!NOTE SSH3 is probably going to change its name. It is still the SSH Connection Protocol RFC4254 running on top of HTTP/3 Extended connect, but the required changes are heavy and too distant from the philosophy of popular SSH implementations to be considered for integration. The specification dra...

bandwhich

bandwhich This is a CLI utility for displaying current network utilization by process, connection and remote IP/hostname Table of contents bandwhich Table of contents Project status How does it work? Installation Downstream packaging status Download a prebuilt binary Building from source...

TrustTunnel

Clients · App store · Play store Table of Contents Introduction Server Features Client Features Quick start Endpoint setup Install the endpoint Updating the endpoint Endpoint configuration wizard Let's Encrypt certificate lifecycle Running endpoint Export client configuration Client setup Install...

rosemary

Rosemary クロスプラットフォームのカーネルレベルピボットプラットフォーム（QUIC 経由）。TUN/TAP 不要。proxychains 不要。プロキシ設定不要。 Rosemary はリモートホスト上のトラフィックをカーネルレベルで透過的に傍受します。プロキシ設定、TUN/TAP デバイス、proxychains は一切不要です。エージェントは QUIC 経由でサーバーに接続します。あたかも直接ネットワークにいるかのように、リモートネットワーク全体に到達できます。 目次 仕組み 機能 対応プラットフォーム スクリーンショット クイックスタート PowerShell エージェント...

tls

ztls A TLS 1.3 implementation for QUIC written in Zig, strictly adhering to RFC 8446 TLS 1.3 and RFC 9001 QUIC-TLS. Status Aspect| Info ---|--- API Stability| Production Zig Version| 0.16.0 Platforms| Linux, macOS, Windows Performance note The 2 ms handshake target is validated on Ed25519 and...

openssl

OpenSSL 프로젝트에 오신 것을 환영합니다 OpenSSL은 강력하고 상용 수준이며 완전한 기능을 갖춘 오픈 소스 툴킷으로, Transport Layer Security TLS, 이전 SSL, Datagram TLS DTLS 및 QUIC 프로토콜을 지원합니다. 프로토콜 구현은 전체 강도의 범용 암호화 라이브러리를 기반으로 하며, 이 라이브러리는 단독으로 사용할 수도 있습니다. 또한 FIPS 표준을 준수하는 것으로 검증된 암호화 모듈이 포함되어 있습니다. OpenSSL은 Eric A. Young과 Tim J. Hudson이 개...

QUIC-attacks

QUIC-attacks CVE-2022-30591 The current repository serves the purpose of sharing the scripts we used for educational usage. These attacks were a part of our study check here, and were tested against 6 different QUIC-enabled servers IIS, NGINX, LiteSpeed, Cloudflare, H2O, and Caddy. The quic-loris...

HTTP3-attacks

HTTP3-attacks CVE-2022-30592 E. Chatzoglou, V. Kouliaridis, G. Kambourakis, G. Karopoulos, and S. Gritzalis의 연구를 기반으로 함:"HTTP/2와 공개 데이터셋을 통해 바라본 HTTP/3 보안에 대한 실전적 고찰", Computers & Security, p. 103051, 2022. 이 저장소는 교육 목적으로 사용했던 스크립트를 공유하기 위해 마련되었습니다. 이 공격들은 연구의 일부였으며, HTTP/3와 통신하도록 설정된 6개의 다른 QUIC...

zeek-spicy-stun

STUN Session Traversal Utilities for NAT STUN This is a Zeek protocol analyzer that detects STUN based on Spicy. You must install Spicy to use this package. This package will create two logs: stun.log - This log has every STUN message. stunnat.log - This log has NAT detections from mapped...

knot-doq

Knot Resolver 6.3.0 — DNS-over-QUICヒープオーバーフロー → RCE（PoC） Knot ResolverのDNS-over-QUIC（DoQ）受信経路における、リモートからトリガー可能なヒープバッファオーバーフローの概念実証です。これは knot-resolver サービスユーザーとしてのリモートコード実行に至ります。 コンポーネント: kresd DoQリスナー（daemon/quicconn.c） 影響を受けるバージョン: Knot Resolver 6.3.0（6.3.0-cznic.1bookworm で検証） 修正バージョン: Knot...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities (CVE-2026-50009, CVE-2026-44894)

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-50009 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless...

quicmap

quicmap かなり高速なQUICサービススキャナー quicmapは、QUICサービス、使用中のプロトコルバージョン、サポートされているALPNを識別するために複数のツールを使う必要をなくす、比較的高速なQUICサービススキャナーです。 主な機能 任意のホスト、IPアドレス、ネットワーク、ポートをスキャンし、QUICサービスを識別します 任意の数のスレッドで実行できます（デフォルトは50） プロセスを高速化するためのALPNのバイナリサーチに対応 素敵なプログレスバー！ インストール root@kitploit: git clone...

CVE-2026-61544

libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after t...

MiracleLinux 9 : openssl-3.5.8-1.el9_8.ML.1 (AXSA:2026-1865:17)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1865:17 advisory. openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server CVE-2026-14456 openssl: QUIC server may trigger double free when...

CVE-2026-33555

HAProxy H3/QUIC スタンドアロン FIN ボディ検証バイパスによる HTTP リクエストスマグリング 完全な記事はこちら : https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html 概要 HAProxy の HTTP/3 実装における脆弱性により、攻撃者は実際のボディサイズと一致しない Content-Length ヘッダーを含む HTTP リクエストを送信できます。HAProxy はこの不正なリクエストを、宣言された Content-Length...

CVE-2025-54939

LSQUIC における QUIC-LEAK CVE-2025-54939 の PoC 概要 この PoC は、LSQUIC QUIC 実装におけるハンドシェイク前のメモリ枯渇（サービス拒否）脆弱性である CVE-2025-54939 を紹介します。 QUIC-LEAK と名付けられたこの問題は、Imperva によって最初に文書化されました:...

CVE-2026-78227

A flaw was found in Unbound. This vulnerability occurs in the DNS-over-QUIC DoQ stream output buffer when a client sends a RESETSTREAM, causing the output buffer to be freed while retransmission entries still point to it. A remote attacker, by querying Unbound over DoQ, withholding acknowledgment...

DEBIAN-CVE-2026-78227

NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffe...

EUVD-2026-80288

NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffe...