XQUIC Project vulnerabilities and threats

CVE-2026-6328 is a high-severity vulnerability in the XQUIC Project's xquic implementation on Linux. It involves improper input validation and improper verification of cryptographic signatures in the QUIC protocol's packet processing and STREAM frame handler modules. This flaw allows protocol manipulation. The vulnerability affects versions up to 1.8.3 of XQUIC. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild.

CVE-2026-1788 is an out-of-bounds write vulnerability in the Xquic Server, a Linux-based QUIC protocol implementation. This flaw occurs in the packet processing module and allows buffer manipulation, potentially leading to memory corruption. The vulnerability affects versions of Xquic Server up to 1.8.3 and does not require authentication or user interaction to exploit. With a CVSS score of 6.6 (medium severity), exploitation could result in partial denial of service or data integrity issues but no direct confidentiality impact is indicated. No known exploits are currently reported in the wild. European organizations using Xquic Server for QUIC traffic handling should prioritize patching once available and implement network-level protections to mitigate risk. Countries with higher adoption of Linux-based infrastructure and advanced internet services are more likely to be impacted.