Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers

A critical vulnerability, dubbed XRING, has been discovered in Alibaba's XQUIC library used for HTTP/3, allowing any remote client to crash servers with simple, legitimate traffic. The flaw lies in a single misplaced variable, and despite its disclosure on July 8 by FoxIO researcher Sébastien Féry, no patch has been issued. This flaw poses a significant risk as it requires no authentication or complex attacks, only a small amount of normal traffic to bring down servers. It highlights the urgent need for robust security measures in networking protocols.