The Hysteria server's HTTP sniffing feature lacks an explicit upper limit on the size of HTTP headers it processes. An attacker can exploit this by sending very large headers without the terminating sequence \r\n\r\n, causing the server to continuously read and buffer data until it runs out of memory or crashes. This vulnerability results in a server-side denial of service (DoS) condition. A proof-of-concept demonstrates sending headers of hundreds of megabytes to trigger the issue. The vulnerability is tracked as GHSA-jqc5-2p7q-fqfc and affects versions of Hysteria before 2.9.2.

Successful exploitation leads to a denial of service on the Hysteria server by exhausting memory resources due to unbounded header size processing. There is no impact on confidentiality or integrity reported. The server may become unresponsive or crash, disrupting service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the HTTP sniffing feature or limiting the size of headers accepted if configurable. Monitor official Hysteria project communications for updates on patches or official fixes.