Unpatched XRING Vulnerability in XQUIC Exposes HTTP/3 Servers to Remo…

An unpatched memory corruption vulnerability (XRING) in Alibaba's XQUIC HTTP/3 library allows remote unauthenticated clients to crash servers with 260 bytes of valid QPACK traffic; all versions through v1.9.4 are affected, including Alibaba's Tengine web server used by Taobao, Alipay, and Alibaba Cloud, with no patch available as of July 2026. If you're running HTTP/3 on XQUIC, you're exposed to remote crash with a single small packet—disable dynamic QPACK compression today or turn off HTTP/3 entirely until Alibaba releases a patch. Anyone relying on Alibaba's Tengine or any XQUIC integration needs to move now, not wait for the CVE.