{"id":"CVE-2026-6328","aliases":["EUVD-2026-22832","GHSA-89j2-h6hv-gvhg"],"status":"published","title":"XQUIC Improper STREAM Frame Validation in Initial/Handshake Packets","description":"Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux (QUIC protocol implementation, packet processing module, STREAM frame handler modules) allows Protocol Manipulation.This issue affects XQUIC: through 1.8.3.","severity":{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00198,"percentile":0.09638,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20","CWE-347"],"published":"2026-04-15T03:18:10Z","modified":"2026-10-28T11:16:57Z","products":[{"vendor":"xquic project","product":"xquic"}],"references":[{"url":"https://github.com/alibaba/xquic/commit/4764604a0e487eeb49338b4498aecda2194eae84","tags":["fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6328","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-89j2-h6hv-gvhg"},{"url":"https://github.com","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6328.json","tags":["advisory"]},{"url":"https://github.com/alibaba/xquic","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-6328","title":"XQUIC Improper STREAM Frame Validation in Initial/Handshake Packets","description":"Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux (QUIC protocol implementation, packet processing module, STREAM frame handler modules) allows Protocol Manipulation.This issue affects XQUIC: through 1.8.3.","status":"published","published":"2026-04-15T03:18:10.428Z","modified":"2026-04-15T16:13:31.813Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-20","CWE-347"],"updated_at":"2026-11-02T13:50:04.986624Z"}],"euvd":[{"id":"EUVD-2026-22832","description":"Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux (QUIC protocol implementation, packet processing module, STREAM frame handler modules) allows Protocol Manipulation.This issue affects XQUIC: through 1.8.3.","status":"published","published":"2026-04-15T03:18:10Z","modified":"2026-04-15T16:13:31Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:24:25.212217Z"}],"ghsa":[{"id":"GHSA-89j2-h6hv-gvhg","title":"Improper input validation, Improper verification of cryptographic signature vulnerability in...","description":"Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux (QUIC protocol implementation, packet processing module, STREAM frame handler modules) allows Protocol Manipulation.This issue affects XQUIC: through 1.8.3.","status":"published","published":"2026-04-17T18:31:50Z","modified":"2026-04-17T18:32:00Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:07:32.404178Z"}],"nvd":[{"id":"CVE-2026-6328","description":"Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux (QUIC protocol implementation, packet processing module, STREAM frame handler modules) allows Protocol Manipulation.This issue affects XQUIC: through 1.8.3.","status":"published","published":"2026-04-15T04:17:48.75Z","modified":"2026-06-17T11:00:40.453Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-20","CWE-347"],"updated_at":"2026-11-02T14:12:14.748836Z"}],"osv":[{"id":"CVE-2026-6328","title":"XQUIC Improper STREAM Frame Validation in Initial/Handshake Packets","description":"Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux (QUIC protocol implementation, packet processing module, STREAM frame handler modules) allows Protocol Manipulation.This issue affects XQUIC: through 1.8.3.","status":"published","published":"2026-04-15T03:18:10.428Z","modified":"2026-10-28T11:16:57.912273201Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-20","CWE-347"],"updated_at":"2026-11-02T15:45:13.306117Z"}]}}