Cybersecurity

260 Bytes Can Crash Your HTTP/3 Server

A flaw nicknamed XRING lets about 260 bytes of ordinary HTTP/3 traffic crash a web server that uses XQUIC, Alibaba's open-source QUIC library. There is no login required, no malformed packet, and as of 10 July no CVE and no fix. The only defence today is a config line you set yourself.

CybersecurityBy Servola Tech Desk2026-07-113 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

What 260 bytes actually do

The flaw, disclosed on 8 July by FoxIO researcher Sebastien Fery and nicknamed XRING, lives in QPACK, the header-compression scheme that HTTP/3 relies on. None of the values in the attack break QPACK's rules. XQUIC advertises a 16 KiB dynamic-table limit by default; the payload asks for 64 bytes, then 65, and drives the table into an exact wrapped memory layout that hits a faulty branch. The server process falls over. No credentials, no oversized packets, nothing a firewall flags as malformed.

That is what makes it dangerous. Most denial-of-service filtering looks for volume or obviously bad input, and XRING is neither. It is a small, well-formed request that a normal client could send by accident, and it does its damage in the parsing path before any application logic runs. Every XQUIC release through v1.9.4, the current one, is affected, and there is no fixed version to upgrade to.

Why you might be running it without knowing

XQUIC is Alibaba's open-source QUIC and HTTP/3 library, which means the risk is not Alibaba's alone. It is embedded in Tengine, the company's Nginx-based web server, which FoxIO says fronts Alibaba's cloud and content-delivery network on properties including Taobao and Alipay. Any operator who pulled XQUIC into their own stack, or who runs a product that bundles it upstream, inherits the same weakness whether or not they know the dependency is there.

This is the uncomfortable part for anyone running modern web infrastructure. HTTP/3 has climbed quietly through CDNs and load balancers, and the libraries underneath are shared. A flaw in one widely embedded QUIC implementation is not a single vendor's problem, it is a supply-chain exposure that surfaces wherever that code was reused. The dependency you cannot name is the one you cannot patch.

The fix is a config line, and no CVE will warn you

Until a corrected release ships, the mitigation is operational, not a download. You can set SETTINGS_QPACK_MAX_TABLE_CAPACITY to 0, which turns off QPACK's dynamic table and removes the vulnerable path, or you can drop HTTP/3 support and fall back to HTTP/2 while a fix is prepared. Both are changes an operator makes to their own configuration today, not a wait for a vendor patch cycle.

The wider lesson is about how the warning arrives, or does not. As of 10 July there is no CVE for XRING, so any team that watches only CVE feeds or waits for a patch-Tuesday bulletin will see nothing. The defensible move is to inventory where HTTP/3 and QPACK actually run in your estate, confirm which QUIC library sits underneath, and treat no CVE yet as a reason to act rather than a reason to relax.

Frequently asked questions

What is the XRING vulnerability?

XRING is a denial-of-service flaw disclosed on 8 July 2026 in XQUIC, Alibaba's open-source QUIC and HTTP/3 library. About 260 bytes of valid QPACK header-compression traffic can crash the server process, with no authentication and no malformed packets required. Every release through v1.9.4 is affected, and as of 10 July there is no CVE and no fixed release.

Am I exposed if I do not use Alibaba software?

Possibly. XQUIC is open source and is embedded in other software, including Tengine, an Nginx-based web server. Any server that serves HTTP/3 using XQUIC with default QPACK settings is affected, even if you obtained it through a third-party product rather than directly from Alibaba. Check which QUIC library your HTTP/3 stack uses.

How do I protect my servers now?

Set SETTINGS_QPACK_MAX_TABLE_CAPACITY to 0 to disable QPACK's dynamic table and remove the vulnerable code path, or turn off HTTP/3 and serve over HTTP/2 until a corrected XQUIC release is available. Both are configuration changes you apply yourself; there is no patch to install as of 10 July.

XRING is a reminder that the scariest flaws are not the loud ones. A few hundred bytes of traffic that breaks no rules, in a library you may not know you depend on, with no CVE to warn you and no patch to install, is exactly the kind of exposure that slips past a team waiting for a bulletin. The servers that stay up this month will be the ones whose operators went looking before anyone told them to.

XRINGXQUICHTTP/3QPACKAlibabaDenial of Service

The Quantum Deadline Hiding in Your Certificates

Cloudflare will move its signatures to ML-DSA now rather than wait for NIST's nine new candidates. For owners, the trust layer is the slow half of post-quantum.

2 min read

Cybersecurity

CISA's First AI Agent Platform Is Now a Must-Patch

CISA added Langflow, a popular tool for building AI agents, to its must-patch list after attackers exploited a flaw to steal companies' AI and cloud keys. It is the first AI agent platform the agency has ever flagged, and the fix is upgrade plus key rotation, now.

3 min read

Digital Sovereignty

The EU Council Revived the Rule That Scans Private Messages

The EU Council revived the lapsed rule that lets providers scan private messages with AI. For owners, confidential communication is now a governance choice.