CVE-2026-6328CWE-20CWE-347

XQUIC Improper STREAM Frame Validation in Initial/Handshake Packets

High · published April 15, 2026

CVSS v4.0
8.3
EPSS
0%
Percentile
12.4
In the wild
Unconfirmed
What it is

Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux (QUIC protocol implementation, packet processing module, STREAM frame handler modules) allows Protocol Manipulation.This issue affects XQUIC: through 1.8.3.

The record
Technical detail
CVSS v4.0
8.3 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00225 · 12.4th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-04-15T03:18Z
EPSS history
Timeline
  • 15 APR 03:18Z
    XQUIC Improper STREAM Frame Validation in Initial/Handshake Packets
    cvelistv5