CVE-2026-6328

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-6328
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6328.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-6328
Published
2026-04-15T03:18:10Z
Modified
2026-10-28T11:16:57Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
XQUIC Improper STREAM Frame Validation in Initial/Handshake Packets
Details

Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux (QUIC protocol implementation, packet processing module, STREAM frame handler modules) allows Protocol Manipulation.This issue affects XQUIC: through 1.8.3.

Database specific 
{
    "cna_assigner":  "alibaba",
    "cwe_ids":  [
        "CWE-20",
        "CWE-347"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6328.json"
}
References

Affected packages

Git / github.com/alibaba/xquic

Affected ranges

Type
GIT
Repo
https://github.com/alibaba/xquic
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
863cf59499b03592696fb6c7188a2fc102c4e5e8
Fixed
4764604a0e487eeb49338b4498aecda2194eae84
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.9.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "ChangesAt"
        },
        {
            "range":  [
                {
                    "fixed":  "4764604a0e487eeb49338b4498aecda2194eae84"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

stable-1.*
stable-1.0.0
stable-1.0.1
v1.*
v1.1.0-beta.1
v1.1.0-beta.2
v1.1.0-stable
v1.2.0-stable
v1.3.0-beta
v1.4.0
v1.5.0
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.7.0
v1.7.1
v1.7.2
v1.8.0
v1.8.1
v1.8.2
v1.8.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6328.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "332206636575830313488336135022884651258",
                "125390721311552705231468860202450840040",
                "70496709984887984695956258242517344022"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-6328-120c977c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/alibaba/xquic/commit/4764604a0e487eeb49338b4498aecda2194eae84",
        "target":  {
            "file":  "src/transport/xqc_frame.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "113333022774093366381828269440543074723",
                "299057689803390314102166936370363950909",
                "174216523501673368871297325698410771816",
                "99338942677483529740230712787429836897"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-6328-7e476404",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/alibaba/xquic/commit/863cf59499b03592696fb6c7188a2fc102c4e5e8",
        "target":  {
            "file":  "src/transport/xqc_conn.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "139789511430105364877333465798509246470",
                "41482445873398392429568676972656612173",
                "311974208164055701552510736792961849962",
                "144118394960112606999825290595909812342",
                "293012500393610354770011289420056103579",
                "79480469026522260047253447312100365764",
                "204417913205369134355360592825579616051"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-6328-a0f3cbfe",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/alibaba/xquic/commit/4764604a0e487eeb49338b4498aecda2194eae84",
        "target":  {
            "file":  "tests/unittest/xqc_process_frame_test.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "288708902266578705964584609167960673884",
            "length":  480
        },
        "id":  "CVE-2026-6328-a2c82c6c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/alibaba/xquic/commit/4764604a0e487eeb49338b4498aecda2194eae84",
        "target":  {
            "file":  "tests/unittest/xqc_process_frame_test.c",
            "function":  "xqc_test_process_frame"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "291021572457810130724846262742285934172",
            "length":  6381
        },
        "id":  "CVE-2026-6328-fec39928",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/alibaba/xquic/commit/4764604a0e487eeb49338b4498aecda2194eae84",
        "target":  {
            "file":  "src/transport/xqc_frame.c",
            "function":  "xqc_process_stream_frame"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:16:57Z"