FoxIO researcher Sébastien Féry disclosed ‘XRING,’ an unpatched vulnerability in Alibaba’s XQUIC library for QUIC and HTTP/3. A single incorrect variable allows any remote client to crash the server with a small burst of legitimate QPACK traffic, requiring no authentication or malformed packets. There is currently no patch available, posing a significant risk to affected HTTP/3 servers.