Peaked at #3 Now #4
QUIC library 0-day and fixes
Researchers disclose a QUIC 0-day letting anyone remotely shut down servers, via QPACK amplification attacks on HTTP/3.
Key points
- @4A4133 announced a 0-Day vulnerability in QUIC that allows anyone to remotely turn off a server running these libraries.
- The original poster listed Cloudflare quiche, quic-go, lsquic and Wireshark as patched, and Bun 1.4.3, h3 (hyperium), aioquic / mitmproxy as unpatched.
- The original poster said vulnerability notifications started a year ago, and that some responded while some didn't.
Key points and the reaction summary are written by AI from the posts on this page. Check the original post. How we use AI
Original post
What others are saying
1 more-
Bun v1.4.4 ships tonight fixing the QUIC zero-day and a Brotli issue; fetch() and Bun.serve() still don't enable HTTP/3 by default.
View on X
Top replies on X
Reaction on X: Replies were largely alarmed jokes and resigned humor, with one user asking for a single list because the patch status was hard to follow. The original poster replied with the patched and unpatched project list.
Sign in to see 5 top replies from X
From @4A4133, @CallMeMrYogurt, @theappcypher and others. Spam removed, with English and Chinese translations.
Discussion 0
Sign up Sign in to join the discussion
No comments yet. Start the conversation.