CVE-2026-42530

🛡️ CVE-2026-42530 - NGINX HTTP/3 QUIC Use-After-Free Vulnerability High-Severity Use-After-Free in NGINX HTTP/3 QUIC ⚠️ QPACK Encoder Stream Vulnerability 🔍 Overview CVE-2026-42530 is a use-after-free vulnerability in NGINX's ngxhttpv3module...

HTTP3-attacks

HTTP3-attacks CVE-2022-30592 Based on the work: E. Chatzoglou, V. Kouliaridis, G. Kambourakis, G. Karopoulos, and S. Gritzalis,"A hands-on gaze on HTTP/3 security through the lens of HTTP/2 and a public dataset", Computers & Security, p. 103051, 2022. The current repository serves the purpose of...

openssl

Bienvenue dans le projet OpenSSL OpenSSL est une boîte à outils open source robuste, de qualité commerciale et complète pour les protocoles Transport Layer Security TLS, anciennement SSL, Datagram TLS DTLS et QUIC. Les implémentations des protocoles sont basées sur une bibliothèque cryptographiqu...

ssh3

!NOTE SSH3 is probably going to change its name. It is still the SSH Connection Protocol RFC4254 running on top of HTTP/3 Extended connect, but the required changes are heavy and too distant from the philosophy of popular SSH implementations to be considered for integration. The specification dra...

zeek-spicy-stun

STUN Session Traversal Utilities for NAT STUN This is a Zeek protocol analyzer that detects STUN based on Spicy. You must install Spicy to use this package. This package will create two logs: stun.log - This log has every STUN message. stunnat.log - This log has NAT detections from mapped...

QUIC-attacks

QUIC-атаки CVE-2022-30591 Текущий репозиторий предназначен для обмена скриптами, которые мы использовали в образовательных целях. Эти атаки были частью нашего исследования см. здесь и были протестированы против 6 различных QUIC-серверов IIS, NGINX, LiteSpeed, Cloudflare, H2O и Caddy. Скрипт...

knot-doq

Knot Resolver 6.3.0 — DNS-over-QUIC-Heap-Überlauf → RCE PoC Proof-of-Concept für einen remote auslösbaren Heap-Pufferüberlauf im DNS-over-QUIC-Empfangspfad DoQ von Knot Resolver, der eine Remote-Codeausführung als der Dienstbenutzer knot-resolver ermöglicht. Komponente: kresd DoQ-Listener...

Chromium: CVE-2026-78893 Information leak in QUIC

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-78966 Externally controlled reference in QUIC

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

tls

ztls Uma implementação TLS 1.3 para QUIC escrita em Zig, aderindo estritamente às RFC 8446 TLS 1.3 e RFC 9001 QUIC-TLS. Estado Aspecto| Info ---|--- Estabilidade da API| Produção Versão do Zig| 0.16.0 Plataformas| Linux, macOS, Windows Nota sobre desempenho O alvo de 2 ms por handshake é validado...

quicmap

quicmap Ziemlich schneller QUIC-Dienst-Scanner quicmap ist ein relativ schneller QUIC-Dienst-Scanner, der die Notwendigkeit beseitigt, mehrere Tools zu verwenden, um QUIC-Dienste, die verwendete Protokollversion sowie unterstützte ALPNs zu identifizieren. Hauptfunktionen Beliebige Hosts,...

CVE-2025-54939

PoC para QUIC-LEAK CVE-2025-54939 no LSQUIC Visão Geral Este PoC destaca a CVE-2025-54939, uma vulnerabilidade de exaustão de memória Negação de Serviço pré-handshake na implementação QUIC do LSQUIC. O problema, denominado QUIC-LEAK, foi documentado pela primeira vez pela Imperva:...

CVE-2026-4253-Scanner

CVE-2026-42530 — Safe-Check Scanner Nicht-destruktiver Massen-Scanner für den NGINX HTTP/3 QUIC Use-after-Free Ermitteln Sie, welche Ihrer Hosts exponiert sind – ohne den Fehler jemals auszulösen. ⚠️ Haftungsausschluss Dieses Tool ist ausschließlich für autorisierte Sicherheitstests bestimmt – für...

CVE-2026-33555

Bypass della Validazione del Body FIN Standalone in HAProxy H3/QUIC tramite HTTP Request Smuggling Post completo qui : https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html Riepilogo Una vulnerabilità nell'implementazione HTTP/3 di HAProxy consente a un attaccante di...

rosemary

Rosemary क्विक QUIC पर क्रॉस-प्लेटफ़ॉर्म कर्नेल-स्तरीय पिवटिंग प्लेटफ़ॉर्म। कोई TUN/TAP नहीं। कोई proxychains नहीं। कोई प्रॉक्सी सेटिंग्स नहीं। Rosemary दूरस्थ होस्टों पर ट्रैफ़िक को कर्नेल स्तर पर पारदर्शी रूप से इंटरसेप्ट करता है: कोई प्रॉक्सी सेटिंग्स नहीं, कोई TUN/TAP डिवाइस नहीं, कोई...

CVE-2026-78966

Externally controlled reference in QUIC in Google Chrome prior to 152...

TrustTunnel

Clienti · App Store · Play Store Sommario Introduzione Funzionalità del server Funzionalità del client Avvio rapido Configurazione dell'endpoint Installare l'endpoint Aggiornare l'endpoint Procedura guidata di configurazione dell'endpoint Ciclo di vita del certificato Let's Encrypt Esecuzione...

CVE-2026-78966

A flaw was found in Google Chrome. An externally controlled reference within the QUIC protocol could allow a remote attacker to bypass the web origin policy. This vulnerability can be exploited by enticing a user to visit a specially crafted HTML page. The bypass of the web origin policy could le...

Linux Distros Unpatched Vulnerability : CVE-2026-78966

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Externally controlled reference in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page...

openssl: QUIC ACK-only packet retention can cause memory exhaustion

A flaw was found in OpenSSL. The QUIC protocol implementation retains metadata for ACK-only packets for the lifetime of a connection, leading to excessive memory consumption. This allows a peer to repeatedly send ack-eliciting packets while not acknowledging ACK-only responses to cause memory...