ssh3

!NOTE SSH3 is probably going to change its name. It is still the SSH Connection Protocol RFC4254 running on top of HTTP/3 Extended connect, but the required changes are heavy and too distant from the philosophy of popular SSH implementations to be considered for integration. The specification dra...

CVE-2026-42530

🛡️ CVE-2026-42530 - NGINX HTTP/3 QUIC Use-After-Free Vulnerability High-Severity Use-After-Free in NGINX HTTP/3 QUIC ⚠️ QPACK Encoder Stream Vulnerability 🔍 Overview CVE-2026-42530 is a use-after-free vulnerability in NGINX's ngxhttpv3module. A remote unauthenticated attacker can trigger it by...

io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical...

TornadoC2

TornadoC2 A pull-based C2 with ten native transports, concurrent multi-profile handlers, and an honest threat model. The agent is a single Go binary with every behavioural property baked in at build time — no runtime config file, no environment variable, no command-line arguments. Tasks and resul...

CVE-2026-4253-Scanner

CVE-2026-42530 — Safe-Check Scanner Non-destructive mass scanner for the NGINX HTTP/3 QUIC use-after-free Inventory which of your hosts are exposed — without ever triggering the bug. ⚠️ Disclaimer This tool is for authorized security testing only — your own infrastructure, or systems you have...

HTTP3-attacks

HTTP3-attacks CVE-2022-30592 Based on the work: E. Chatzoglou, V. Kouliaridis, G. Kambourakis, G. Karopoulos, and S. Gritzalis,"A hands-on gaze on HTTP/3 security through the lens of HTTP/2 and a public dataset", Computers & Security, p. 103051, 2022. The current repository serves the purpose of...

CVE-2025-64702-more

CVE-2025-64702-more CVE-2025-64702, CVE-2026-12523, CVE-2025-13945 Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten...

CVE-2026-42530

CVE-2026-42530 Scanner for CVE-2026-42530, a use-after-free in nginx's HTTP/3 module. Affected: nginx 1.31.0, 1.31.1 Fixed: nginx 1.31.2 Usage pip install aioquic python3 scannerCVE-2026-42530.py port python3 scannerCVE-2026-42530.py --file hosts.txt How it works Opens two QPACK encoder streams o...

HTTP3-Adapter

HTTP/3-Adapter A Burp Suite extension that sends requests over HTTP/3. Burp does not support HTTP/3 natively. This extension implements a HTTP/3 stack, intercepts all requests, converts and sends them over HTTP/3 and then converts the response back into a HTTP version that burp can understand...

HTTP3ONSTEROIDS

Table of contents Vulnerability Description Source Code Review Lab Setup Identifying the issue References Vulnerability Description HAProxy's HTTP/3 implementation fails to block a malformed HTTP header field name , and when deployed in front of a server that incorrectly process this malformed...

CVE-2026-33555

HTTP Request Smuggling via HAProxy H3/QUIC Standalone FIN Body Validation Bypass Full post here : https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html Summary A vulnerability in HAProxy's HTTP/3 implementation allows an attacker to send an HTTP request with a...

CLEANSTART-2026-SH36896 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)

Security vulnerability affects the cassandra-reaper-fips package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...

CVE-2026-119559

OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext implementation that always returns true, attackers can present a...

CVE-2026-119559 OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch

OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext implementation that always returns true, attackers can present a...

CVE-2026-119559

OpenLiteSpeed versions through 1.9.4 are vulnerable to an authentication bypass over HTTP/3 . The root cause is that the QuicStream component inherits a verifyContext() implementation that consistently returns true. This allows unauthenticated remote attackers to evade virtual host client certifi...

CVE-2026-119559 OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch

OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext implementation that always returns true, attackers can present a...

EUVD-2026-113824

OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext implementation that always returns true, attackers can present a...

CLEANSTART-2026-IV43958 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)

CVE-2026-6790 affects multiple packages. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. See references for individual vulnerability details...

PT-2026-133497

OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext implementation that always returns true, attackers can present a...

LiteSpeed Tech OpenLiteSpeed Web Server encryption issue vulnerability

LiteSpeed Tech OpenLiteSpeed Web Server versions 1.9.4 and earlier contain an encryption-related vulnerability. This vulnerability arises because QuicStream inherits a verifyContext implementation that always returns true. Unauthenticated remote attackers can exploit this by using SNI and protect...