{"id":"CVE-2026-6328","state":"PUBLISHED","title":"XQUIC Improper STREAM Frame Validation in Initial/Handshake Packets","description":"Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux (QUIC protocol implementation, packet processing module, STREAM frame handler modules) allows Protocol Manipulation.This issue affects XQUIC: through 1.8.3.","publishedAt":"2026-04-15T03:18:10.428Z","updatedAt":"2026-04-15T16:13:31.813Z","severity":{"score":8.3,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","source":"alibaba"},"assigner":"alibaba","products":["XQUIC Project XQUIC"],"affected":[{"vendor":"XQUIC Project","product":"XQUIC","packageName":"xquic","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.8.3","changes":[{"at":"1.9.0","status":"unaffected"}],"versionType":"custom"}],"platforms":["Linux"],"collectionURL":"https://github.com","repo":"https://github.com/alibaba/xquic","modules":["QUIC protocol implementation","packet processing module","STREAM frame handler"]}],"references":["https://github.com/alibaba/xquic/commit/4764604a0e487eeb49338b4498aecda2194eae84"],"weaknesses":["CWE-20","CWE-347"],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/6xxx/CVE-2026-6328.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-6328","state":"PUBLISHED","datePublished":"2026-04-15T03:18:10.428Z","dateUpdated":"2026-04-15T16:13:31.813Z","assignerShortName":"alibaba","assignerOrgId":"0cc2b86d-1d45-434d-ae74-11d09ec61ae8","dateReserved":"2026-04-15T02:43:22.187Z"},"containers":{"cna":{"title":"XQUIC Improper STREAM Frame Validation in Initial/Handshake Packets","descriptions":[{"lang":"en","value":"Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux (QUIC protocol implementation, packet processing module, STREAM frame handler modules) allows Protocol Manipulation.This issue affects XQUIC: through 1.8.3."}],"affected":[{"vendor":"XQUIC Project","product":"XQUIC","packageName":"xquic","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.8.3","changes":[{"at":"1.9.0","status":"unaffected"}],"versionType":"custom"}],"platforms":["Linux"],"collectionURL":"https://github.com","repo":"https://github.com/alibaba/xquic","modules":["QUIC protocol implementation","packet processing module","STREAM frame handler"]}],"references":[{"url":"https://github.com/alibaba/xquic/commit/4764604a0e487eeb49338b4498aecda2194eae84"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":8.3,"vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","lang":"en","description":"CWE-20 Improper input validation","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-347","lang":"en","description":"CWE-347 Improper verification of cryptographic signature","type":"CWE"}]}],"providerMetadata":{"shortName":"alibaba","orgId":"0cc2b86d-1d45-434d-ae74-11d09ec61ae8","dateUpdated":"2026-04-15T03:18:10.428Z"},"impacts":[{"capecId":"CAPEC-272","descriptions":[{"lang":"en","value":"CAPEC-272 Protocol Manipulation"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.1"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-15T13:47:01.676715Z","id":"CVE-2026-6328","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-15T16:13:31.813Z"}}]}}}