CVE-2026-42530

🛡️ CVE-2026-42530 - Vulnerabilidade de Use-After-Free no NGINX HTTP/3 QUIC Use-After-Free de Alta Gravidade no NGINX HTTP/3 QUIC ⚠️ Vulnerabilidade do Fluxo do Codificador QPACK 🔍 Visão Geral CVE-2026-42530 é uma vulnerabilidade no módulo do NGINX...

CVE-2025-54939

PoC para QUIC-LEAK CVE-2025-54939 no LSQUIC Visão Geral Este PoC destaca a CVE-2025-54939, uma vulnerabilidade de exaustão de memória Negação de Serviço pré-handshake na implementação QUIC do LSQUIC. O problema, denominado QUIC-LEAK, foi documentado pela primeira vez pela Imperva:...

CVE-2026-4253-Scanner

CVE-2026-42530 — Scanner Safe-Check Scanner em massa não destrutivo para o use-after-free do NGINX HTTP/3 QUIC Inventarie quais dos seus hosts estão expostos — sem nunca acionar a falha. ⚠️ Aviso legal Esta ferramenta destina-se somente a testes de segurança autorizados — na sua própria...

quicmap

quicmap Bastante rápido scanner de serviços QUIC quicmap é um scanner de serviços QUIC relativamente rápido que elimina a necessidade de usar múltiplas ferramentas para identificar serviços QUIC, a versão do protocolo em uso, bem como os ALPNs suportados. Principais recursos Escanear hosts...

TrustTunnel

Clientes · App Store · Play Store Índice Introdução Funcionalidades do Servidor Funcionalidades do Cliente Início rápido Configuração do endpoint Instalar o endpoint Atualizar o endpoint Assistente de configuração do endpoint Ciclo de vida do certificado Let's Encrypt Executar o endpoint Exportar...

CVE-2026-78966

CVE-2026-78966 is an externally controlled reference vulnerability in the QUIC component of Google Chrome prior to version 152.0.7977.65 . A remote attacker could exploit this via a crafted HTML page to bypass the web origin policy , potentially accessing cross-origin data that should be restrict...

CVE-2026-78893

An information leak vulnerability exists in the QUIC component of Google Chrome prior to version 152.0.7977.65 . A remote attacker can exploit this flaw via a crafted HTML page to exfiltrate sensitive information from the browser. Chromium classifies the security severity as Medium . The fix is a...

zeek-quic

Zeek के लिए Google QUIC विश्लेषक/डिटेक्टर यह विश्लेषक QUIC के Google कार्यान्वयन को पार्स और डिटेक्ट कर सकता है यहाँ सरलता के लिए GQUIC कहा गया, जो निम्नलिखित wire format का उपयोग करता है: https://www.chromium.org/quic. इस विश्लेषक को लिखने के समय Chrome द्वारा उपयोग किया जाने वाला GQUIC संस्करण...

CVE-2026-18798

A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID destination connection ID can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service. Mitigatio...

CVE-2026-63075

A flaw was found in OpenSSL. The QUIC protocol implementation retains metadata for ACK-only packets for the lifetime of a connection, leading to excessive memory consumption. This allows a peer to repeatedly send ack-eliciting packets while not acknowledging ACK-only responses to cause memory...

openssl

OpenSSL परियोजना में आपका स्वागत है OpenSSL एक मजबूत, व्यावसायिक-श्रेणी का, पूर्ण-विशेषताओं वाला ओपन सोर्स टूलकिट है ट्रांसपोर्ट लेयर सिक्योरिटी TLS, पूर्व में SSL, डेटाग्राम TLS DTLS, और QUIC प्रोटोकॉल के लिए। प्रोटोकॉल कार्यान्वयन एक पूर्ण-शक्ति वाली सामान्य प्रयोजन क्रिप्टोग्राफिक लाइब्रेरी पर...

QUIC-attacks

QUIC-attacks CVE-2022-30591 O presente repositório serve para compartilhar os scripts que usamos para fins educacionais. Esses ataques fizeram parte do nosso estudo veja aqui e foram testados contra 6 servidores diferentes habilitados para QUIC IIS, NGINX, LiteSpeed, Cloudflare, H2O e Caddy. O...

HTTP3-attacks

HTTP3-attacks CVE-2022-30592 Com base no trabalho: E. Chatzoglou, V. Kouliaridis, G. Kambourakis, G. Karopoulos e S. Gritzalis,"A hands-on gaze on HTTP/3 security through the lens of HTTP/2 and a public dataset", Computers & Security, p. 103051, 2022. O repositório atual tem a finalidade de...

CVE-2026-63075

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC...

CVE-2026-18798

Issue summary: QUIC server may double free QRX QUIC record layer RX object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence...

CVE-2026-63075

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC...

CVE-2026-63075 QUIC ACK-only Packet Retention Can Cause Memory Exhaustion

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC...

EUVD-2026-65485

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC...

CVE-2026-63075

OpenSSL's QUIC stack retains ACK-only packet metadata in its packet history for the full lifetime of a connection. Since ACK-only packets are not ack-eliciting, a remote peer that completes a QUIC handshake can force repeated ACK-only packet transmission (e.g., by sending numerous PING frames ) a...

CVE-2026-18798 QUIC Server May Trigger Double Free When Processing INITIAL Packet

Issue summary: QUIC server may double free QRX QUIC record layer RX object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence...