deluded-openssl-3.2.0

Bienvenido al Proyecto OpenSSL OpenSSL es un kit de herramientas Open Source robusto, de grado comercial y con todas las funciones para los protocolos TLS anteriormente SSL, DTLS y QUIC actualmente solo del lado del cliente. Las implementaciones de los protocolos se basan en una biblioteca...

GHSA-92F5-VC22-8J33 Microsoft QUIC: Remote Code Execution Vulnerability

Summary Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. Details New network path creations and removals triggered by incoming packets can lead to a pointer invalidation. Patches - Guard path promotion e0f55b5 Impact An unauthenticated attacker coul...

EUVD-2026-56392

Microsoft QUIC: Remote Code Execution Vulnerability...

zeek-quic

Google QUIC 分析器/检测器：用于 Zeek 此分析器可以解析并检测 Google 实现的 QUIC（此处简称为 GQUIC），其使用的线上格式描述于： https://www.chromium.org/quic。 在编写此分析器时，Chrome 所使用的 GQUIC 版本为 Q039，部分 Google 服务器（以及可能的 Chrome canary 版本）也能够使用 Q043。 在测试期间，此分析器能够检测到上述两个版本。 当时（2018 年 5 月 4 日至 5 日）GQUIC 文档中描述的线上格式，似乎也与实际环境中的真实实现不同步。 此外，似乎一直有持续的努力将...

CVE-2026-6060-QUIC-Handshake-Amplification-via-Address-Validation-Bypass

CVE-2026-6060 – 通过地址验证绕过实现的 QUIC 握手放大 程序代码（Python 模拟） root@kitploit: quicserversim.py - Vulnerable QUIC server simulated handshake import socket def sendquicinitialconn, addr, serversalt: Respond with a large "server hello" without validating source address In real QUIC, the server must echo the...

CVE-2026-4253-Scanner

CVE-2026-42530 — Safe-Check 扫描器 针对 NGINX HTTP/3（QUIC）释放后使用漏洞的非破坏性批量扫描器 在不触发漏洞的前提下，盘点你的哪些主机存在风险。 ⚠️ 免责声明 本工具仅用于授权的安全测试 ——测试你自己的基础设施，或你有明确书面授权进行评估的系统。它执行只读指纹识别 ，并不会 利用漏洞。你有责任确保测试在授权范围内，并遵守适用法律及负责任的披露原则。作者不对滥用行为承担任何责任。 🔍 关于漏洞 CVE-2026-42530 是 NGINX 的 ngxhttpv3module 中存在的释放后使用漏洞（CWE-416）。当 NGINX 配置为提供...

CVE-2026-42530

🛡️ CVE-2026-42530 - NGINX HTTP/3 QUIC Use-After-Free Vulnerability High-Severity Use-After-Free in NGINX HTTP/3 QUIC ⚠️ QPACK Encoder Stream Vulnerability 🔍 Overview CVE-2026-42530 is a use-after-free vulnerability in NGINX's ngxhttpv3module. A remote unauthenticated attacker can trigger it by...

knot-doq

Knot Resolver 6.3.0 — DNS-over-QUIC heap overflow → RCE PoC Proof-of-concept for a remotely triggerable heap buffer overflow in Knot Resolver's DNS-over-QUIC DoQ receive path that yields remote code execution as the knot-resolver service user. Component: kresd DoQ listener daemon/quicconn.c...

CVE-2026-78662

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

TrustTunnel v1.1.0

Clients · App store · Play store Table of Contents Introduction Server Features Client Features Quick start Endpoint setup Install the endpoint Updating the endpoint Endpoint configuration wizard Let's Encrypt certificate lifecycle Running endpoint Export client configuration Client setup Install...

Updated openssl packages fix security vulnerabilities

Unbounded Memory Growth in QUIC Server Incoming Channel Queue. CVE-2026-14456 QUIC Server May Trigger Double Free When Processing INITIAL Packet. CVE-2026-18798 Heap Buffer Overflow in CMS Key Unwrapping. CVE-2026-63072 Invalid Pointer Dereference in CMP Server via Crafted protectionAlg...

MGASA-2026-0353 Updated openssl packages fix security vulnerabilities

Unbounded Memory Growth in QUIC Server Incoming Channel Queue. CVE-2026-14456 QUIC Server May Trigger Double Free When Processing INITIAL Packet. CVE-2026-18798 Heap Buffer Overflow in CMS Key Unwrapping. CVE-2026-63072 Invalid Pointer Dereference in CMP Server via Crafted protectionAlg...

USN-8678-3: OpenSSL vulnerability

USN-8673-1 fixed vulnerabilities in OpenSSL. The update inadvertently left out the fix for CVE-2026-75803 in Ubuntu 26.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that OpenSSL incorrectly handled the QUIC server incoming...

SUSE CVE-2026-18798

Issue summary: QUIC server may double free QRX QUIC record layer RX object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence...

Chromium: CVE-2026-78893 Information leak in QUIC

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-78966 Externally controlled reference in QUIC

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

SUSE CVE-2026-14456

Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the serve...

SUSE CVE-2026-63075

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC...

QUIC ACK-only Packet Retention Can Cause Memory Exhaustion

...

CVE-2026-78966

A flaw was found in Google Chrome. An externally controlled reference within the QUIC protocol could allow a remote attacker to bypass the web origin policy. This vulnerability can be exploited by enticing a user to visit a specially crafted HTML page. The bypass of the web origin policy could le...