Skip to content
OpenAdvisories

Package · Go

github.com/apernet/hysteria/core

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.4
    GHSA-vgrc-hq28-p3xp

    Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF

    ## Summary Hysteria's UDP relay treats the destination address as packet-scoped, but ACL and outbound policy are applied only once when a new UDP session is created. After an authenticated client opens a UDP session using an allowed first destination, later p…

    github.com/apernet/hysteria/core/v2 github.com/apernet/hysteria/core Go
  • High 8.8
    GHSA-9fw6-xgg2-mq9q

    Hysteria: A specially constructed quic package can crash the server OOM when the sniff is enabled

    ### Summary A specially constructed quic package can crash the server OOM when the sniff is enabled. ### Details When the server has sniff enabled, a valid connection can request the server to forward UDP traffic and construct a huge crypto length. The server…

    github.com/apernet/hysteria/core github.com/apernet/hysteria/core/v2 Go