Http3 — PoC Archivehttps://poc.intelseclab.com/tags/http3/Latest proof-of-concept entries.Hugoen-usWed, 08 Jul 2026 00:00:00 +0000XRING — XQUIC QPACK Ring Buffer Resize Underflow (Remote Unauthenticated DoS)https://poc.intelseclab.com/pocs/network/2026-07-08_xring-xquic-qpack-ring-mem-resize-underflow/Wed, 08 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-08_xring-xquic-qpack-ring-mem-resize-underflow/Critical severity — network. Status: Weaponized (public PoC, unpatched at publication). Affects: [alibaba/xquic](https://github.com/alibaba/xquic) — QUIC/HTTP-3 library, used by Tengine and reportedly across Alibaba's cloud/CDN infrastructure (Taobao, AliPay). Tags: quic, http3, qpack, xquic, alibaba, tengine, ring-buffer, integer-underflow, heap-oob-read, memcpy, remote, unauthenticated, dos, no-cve.networkCriticalquichttp3qpackxquicalibabatenginering-bufferinteger-underflowheap-oob-readmemcpyremoteunauthenticateddosno-cveHAProxy HTTP/3 (QUIC) Standalone FIN Body Validation Bypass Leading to Request Smuggling — CVE-2026-33555https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-33555-haproxy-h3-request-smuggling/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-33555-haproxy-h3-request-smuggling/High severity — network · CVE-2026-33555. Status: PoC. Affects: HAProxy with HTTP/3 (QUIC) support built (USE_QUIC=1); tested on HAProxy 3.0.18. Tags: haproxy, http3, quic, request-smuggling, http-reuse, content-length, reverse-proxy, cross-user.networkHighhaproxyhttp3quicrequest-smugglinghttp-reusecontent-lengthreverse-proxycross-user