Security advisories

high2026-06-26

Hysteria: http large header with sniff cause server DoS

GHSA-jqc5-2p7q-fqfc

high2026-06-26

Hysteria vulnerable to server crash when max_datagram_frame_size very small

GHSA-qh5x-rfwf-rvfv

high2026-06-26

Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF

GHSA-vgrc-hq28-p3xp

high2026-05-05

Hysteria: A specially constructed quic package can crash the server OOM when the sniff is enabled

GHSA-9fw6-xgg2-mq9q