PT-2026-33006 · Xquic · Xquic

Published 2026-04-15 · Updated 2026-06-08 · CVE-2026-6328

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions XQUIC versions prior to 1.8.3

Description Improper input validation and improper verification of cryptographic signatures in the QUIC protocol implementation, specifically within the packet processing module and STREAM frame handler modules, allow for protocol manipulation.

Recommendations Update to a version newer than 1.8.3.

Fix

RCE

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-20

CWE-347

Related Identifiers

CVE-2026-6328

Affected Products

Xquic

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-6328 · Security Note
• https://github.com/alibaba/xquic/commit/4764604a0e487eeb49338b4498aecda2194eae84 · Note
• https://t.me/cveNotify/164016 · Telegram Post
• https://twitter.com/CVEnew/status/2044338848407425307 · Twitter Post
• https://twitter.com/YourAnon_irc/status/2063883449115492585 · Twitter Post