CVE-2026-6328

CVE-2026-6328 is an input validation and cryptographic signature verification vulnerability in the XQUIC protocol implementation affecting versions through 1.8.3 on Linux systems. The flaw resides in the packet processing and STREAM frame handler modules, enabling protocol manipulation attacks. This vulnerability impacts XQUIC, an open-source QUIC protocol library, and could allow attackers to bypass security controls through specially crafted network packets. The attack complexity appears moderate, as the vulnerability requires manipulation of protocol-level packets rather than simple input injection. While specific CVSS metrics are unavailable, the FAUCET Risk Score of 40.0/100 indicates a moderate-level threat requiring attention. The primary concern is protocol integrity and potential packet manipulation leading to session hijacking or data tampering. The vulnerability currently has no known active exploitation in the wild, with an EPSS score of 0.0004 indicating minimal real-world exploitation probability. It has not been added to CISA's Known Exploited Vulnerabilities catalog, and community attention appears limited. Organizations running XQUIC should prioritize patching beyond version 1.8.3, though immediate emergency response measures are not warranted given the current threat landscape.