Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Sending an excessively large header by an attacker could lead to a server-side DoS attack. Details The current sniff implementation does not explicitly specify the upper limit for HTTP headers. Attackers can continuously send excessively large headers without including \r\n\r\n, leading to ServerDoS and OutOfMemory errors. PoC server.yaml poc.sh poc.go Impact Testing showed that the server side used a maximum of 16GB. Server memory DoS and may cause OOM.
Recommended action: Upgrade to 2.9.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An authenticated client can crash the Hysteria server by advertising a very small QUIC maxdatagramframesize and then triggering a UDP response from the server. When the server tries to send the UDP response back via QUIC DATAGRAM, quic-go returns DatagramTooLargeError. The server then attempts to fragment the Hysteria UDP message, but the fragmentation code does not handle the case where the UDP message header itself is larger than the maximum datagram payload size. This results in a slice bounds panic and terminates the server process. Details The vulnerable path is the normal server-side UDP response path: In core/server/udp.go, receiveLoop packages a UDP response into a protocol.UDPMessage and calls sendMessageAutoFrag. If SendDatagram fails with quic.DatagramTooLargeError, sendMessageAutoFrag calls: However, FragUDPMessage in core/internal/frag/frag.go assumes that maxSize is greater than the UDP message header size: If an attacker-controlled client advertises a small…
Recommended action: Upgrade to 2.9.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.