Nginx QUIC/HTTP-3 DCID Length Heap Overflow Lab (CVE-2026-0211)

Metadata

Affected Target

Summary

This repository is a university penetration-testing course project that models a hypothetical heap buffer overflow in Nginx’s QUIC (HTTP/3) packet parser, where the Destination Connection ID (DCID) length field is not properly bounds-checked before being used to read/copy the DCID bytes. The lab target is a custom-built, intentionally vulnerable Nginx container (not real-world production Nginx) fronting a mock “enterprise security gateway” website inside an isolated Docker network. Included Python tooling probes for QUIC/HTTP-3 support, crafts QUIC Initial packets with an oversized DCID length (0xFF / 255 bytes against an expected max of ~20), and either fuzzes the target with Scapy-crafted packets or floods it with malformed packets across many threads to trigger crashes/resource exhaustion. A companion patch under src/savunma/ demonstrates the defensive fix (stricter DCID length + buffer-bounds validation) that closes the simulated hole. Framed honestly, this is an academic reproduction of a QUIC parser bug class rather than an exploit against a currently-shipping Nginx release.

Vulnerability Details

Root Cause

The lab’s modified QUIC transport parser accepts a DCID length value that exceeds NGX_QUIC_CID_LEN_MAX (and specifically the sentinel value 0xFF) without rejecting the packet, allowing a crafted DCID length to drive an out-of-bounds read/copy from the packet buffer into a fixed-size heap-allocated CID structure.

Attack Vector

1. Attacker runs 01_recon.py to send a dummy QUIC Initial packet over UDP and confirm the target answers on the HTTP/3 port.
2. Attacker (via fuzzer.py) crafts a QUIC long-header Initial packet with dcid_len = 0xFF followed by 255 bytes of filler, and a normal-looking SCID, and sends it with Scapy.
3. The lab-vulnerable parser copies the oversized DCID into a fixed-size heap buffer without validating the length against the buffer capacity, corrupting adjacent heap memory (detected via ASAN in the lab’s target container).
4. Alternatively, 03_dos.py repeatedly floods the same malformed-DCID payload from many threads to exhaust CPU/memory and deny service.
5. Analysts inspect the target container’s ASAN/Nginx logs to confirm the crash and root-cause the overflow.

Impact

In the lab environment: heap memory corruption and process crash (denial of service) in the simulated Nginx QUIC parser, with the accompanying RCE payload template illustrating how a real-world equivalent bug of this class could theoretically be leveraged for code execution — this specific repository does not demonstrate actual code execution against production Nginx.

Environment / Lab Setup

Target:   Docker container "target_nginx" — custom lab-patched Nginx 1.25.3 with HTTP/3 (10.13.37.10:443)
Attacker: Docker Compose, Python 3 with scapy, internal bridge network 10.13.37.0/24

Proof of Concept

PoC Script

See src/saldiri/01_recon.py, src/saldiri/03_dos.py, src/saldiri/fuzzer.py, src/saldiri/payloads/, src/savunma/CVE-2026-0211-defense.patch, and docker-compose.yml in this folder.

1
2
3

docker compose up -d --build
docker exec fuzzer_node python3 /fuzzer/01_recon.py 10.13.37.10 443
docker exec fuzzer_node python3 /fuzzer/03_dos.py 10.13.37.10 443 10

01_recon.py confirms QUIC/HTTP-3 is reachable; fuzzer.py sends a single crafted malformed-DCID QUIC Initial packet via Scapy to trigger the overflow; 03_dos.py repeats a similar malformed packet across multiple threads for sustained denial-of-service testing. Crash evidence is checked via the target container’s ASAN logs.

Detection & Indicators of Compromise

Signs of compromise:

• Nginx worker crashes or restarts correlated with inbound QUIC Initial packets carrying dcid_len near or at 0xFF
• Spikes in malformed UDP/443 traffic from a small number of source IPs
• ASAN/crash logs referencing ngx_event_quic_transport.c DCID parsing

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/frudotz/ISU-SecOps-Nginx-RCE on 2026-07-05.