{"id":"CVE-2026-6328","summary":"XQUIC Improper STREAM Frame Validation in Initial/Handshake Packets","details":"Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux (QUIC protocol implementation, packet processing module, STREAM frame handler modules) allows Protocol Manipulation.This issue affects XQUIC: through 1.8.3.","modified":"2026-10-28T11:16:57.912273201Z","published":"2026-04-15T03:18:10.428Z","database_specific":{"cwe_ids":["CWE-20","CWE-347"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6328.json","cna_assigner":"alibaba"},"references":[{"type":"WEB","url":"https://github.com"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6328.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6328"},{"type":"FIX","url":"https://github.com/alibaba/xquic/commit/4764604a0e487eeb49338b4498aecda2194eae84"},{"type":"PACKAGE","url":"https://github.com/alibaba/xquic"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/alibaba/xquic","events":[{"introduced":"0"},{"fixed":"863cf59499b03592696fb6c7188a2fc102c4e5e8"},{"fixed":"4764604a0e487eeb49338b4498aecda2194eae84"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"1.9.0"}],"source":"AFFECTED_FIELD","strategy":"ChangesAt"},{"range":[{"fixed":"4764604a0e487eeb49338b4498aecda2194eae84"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v1.8.3","v1.8.2","v1.8.1","v1.8.0","v1.7.2","v1.7.1","v1.7.0","v1.6.3","v1.6.2","v1.6.1","v1.6.0","v1.5.0","v1.4.0","v1.3.0-beta","v1.2.0-stable","v1.1.0-stable","v1.1.0-beta.2","v1.1.0-beta.1","stable-1.0.1","stable-1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6328.json","vanir_signatures":[{"id":"CVE-2026-6328-120c977c","signature_type":"Line","signature_version":"v1","source":"https://github.com/alibaba/xquic/commit/4764604a0e487eeb49338b4498aecda2194eae84","target":{"file":"src/transport/xqc_frame.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["332206636575830313488336135022884651258","125390721311552705231468860202450840040","70496709984887984695956258242517344022"]}},{"target":{"file":"src/transport/xqc_conn.h"},"deprecated":false,"digest":{"line_hashes":["113333022774093366381828269440543074723","299057689803390314102166936370363950909","174216523501673368871297325698410771816","99338942677483529740230712787429836897"],"threshold":0.9},"id":"CVE-2026-6328-7e476404","signature_type":"Line","signature_version":"v1","source":"https://github.com/alibaba/xquic/commit/863cf59499b03592696fb6c7188a2fc102c4e5e8"},{"id":"CVE-2026-6328-a0f3cbfe","signature_type":"Line","signature_version":"v1","source":"https://github.com/alibaba/xquic/commit/4764604a0e487eeb49338b4498aecda2194eae84","target":{"file":"tests/unittest/xqc_process_frame_test.c"},"deprecated":false,"digest":{"line_hashes":["139789511430105364877333465798509246470","41482445873398392429568676972656612173","311974208164055701552510736792961849962","144118394960112606999825290595909812342","293012500393610354770011289420056103579","79480469026522260047253447312100365764","204417913205369134355360592825579616051"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/alibaba/xquic/commit/4764604a0e487eeb49338b4498aecda2194eae84","target":{"function":"xqc_test_process_frame","file":"tests/unittest/xqc_process_frame_test.c"},"deprecated":false,"digest":{"function_hash":"288708902266578705964584609167960673884","length":480},"id":"CVE-2026-6328-a2c82c6c"},{"signature_version":"v1","source":"https://github.com/alibaba/xquic/commit/4764604a0e487eeb49338b4498aecda2194eae84","target":{"file":"src/transport/xqc_frame.c","function":"xqc_process_stream_frame"},"deprecated":false,"digest":{"function_hash":"291021572457810130724846262742285934172","length":6381},"id":"CVE-2026-6328-fec39928","signature_type":"Function"}],"vanir_signatures_modified":"2026-10-28T11:16:57Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"}]}