Skip to content
Verified reproduction

REPRO-2026-00284: XRING: Alibaba XQUIC QPACK ring-buffer resize underflow

REPRO-2026-00284 is verified against Alibaba XQUIC · github affected versions: All XQUIC versions through v1.9.4 (since first public release Jan 2022) This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00284.

REPRO-2026-00284 Alibaba XQUIC · github Variant found Jul 11, 2026 .txt
Severity HIGH
Confidence HIGH
Reproduced in 20m 53s
Tool calls 242
Spend $3.57
Affected All XQUIC versions through v1.9.4 (since first public release Jan 2022)
$ pruva-verify REPRO-2026-00284
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00284/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
02 · The vulnerability

Novel unknown 0-day investigation in the latest available Alibaba XQUIC release. We are confident a fresh exploitable issue exists, but the vulnerable path, trigger, sink, and exact attack surface are unknown. Agents must independently discover the attack surface, identify the execution primitive, and reproduce code execution or crash-from-exploitation from scratch against the latest release. This is a discovery-first task and should not be treated as a simple replay of a prior disclosure; search broadly for any new HTTP/3, QPACK, ring-buffer, or transport parsing path that yields exploitation.

03 · Root cause
Variant analysis
04 · Reproduction transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.

Loading session...

05 · Artifacts

Scripts, logs, diffs, and output captured during the reproduction.

bundle/artifact_promotion_manifest.json16.7 KB
bundle/artifact_promotion_report.json16.7 KB
bundle/vuln_variant/source_identity.json2.6 KB
bundle/vuln_variant/root_cause_equivalence.json4.6 KB
bundle/repro/reproduction_steps.sh14.4 KB
bundle/repro/runtime_manifest.json1.1 KB
bundle/repro/validation_verdict.json1.2 KB
bundle/repro/rca_report.md10.9 KB
bundle/logs/vuln_attempt1_server.stderr0.0 KB
bundle/logs/repro_run1.log1.9 KB
bundle/logs/vuln_attempt1_client.stdout0.0 KB
bundle/logs/vuln_attempt1_result.txt0.1 KB
bundle/logs/fixed_attempt1_server.stderr0.0 KB
bundle/logs/fixed_attempt1_client.stdout0.0 KB
bundle/logs/fixed_attempt1_result.txt0.1 KB
bundle/logs/vuln_attempt2_server.stderr0.0 KB
bundle/logs/vuln_attempt2_client.stdout0.0 KB
bundle/logs/vuln_attempt2_result.txt0.1 KB
bundle/logs/fixed_attempt2_server.stderr0.0 KB
bundle/logs/fixed_attempt2_client.stdout0.0 KB
bundle/logs/fixed_attempt2_result.txt0.1 KB
bundle/vuln_variant/reproduction_steps.sh16.5 KB
bundle/logs/vuln_variant/variant_matrix_summary.txt0.4 KB
bundle/logs/vuln_variant/vuln_P1_server.stderr9.0 KB
bundle/logs/vuln_variant/vuln_P3_server.stderr9.0 KB
bundle/logs/vuln_variant/fixed_P1_server.stderr0.0 KB
bundle/vuln_variant/validation_verdict.json4.4 KB
bundle/vuln_variant/variant_manifest.json5.0 KB
bundle/vuln_variant/patch_analysis.md9.0 KB
bundle/vuln_variant/rca_report.md11.3 KB
bundle/vuln_variant/runtime_manifest.json2.2 KB
bundle/logs/vuln_variant/vuln_P1_client.stdout0.1 KB
bundle/logs/vuln_variant/vuln_P1_result.txt0.1 KB
bundle/logs/vuln_variant/fixed_P1_client.stdout0.1 KB
bundle/logs/vuln_variant/fixed_P1_result.txt0.1 KB
bundle/logs/vuln_variant/vuln_P2_server.stderr9.0 KB
bundle/logs/vuln_variant/vuln_P2_client.stdout0.1 KB
bundle/logs/vuln_variant/vuln_P2_result.txt0.1 KB
bundle/logs/vuln_variant/fixed_P2_server.stderr0.0 KB
bundle/logs/vuln_variant/fixed_P2_client.stdout0.1 KB
bundle/logs/vuln_variant/fixed_P2_result.txt0.1 KB
bundle/logs/vuln_variant/vuln_P3_client.stdout0.1 KB
bundle/logs/vuln_variant/vuln_P3_result.txt0.1 KB
bundle/logs/vuln_variant/fixed_P3_server.stderr0.0 KB
bundle/logs/vuln_variant/fixed_P3_client.stdout0.1 KB
bundle/logs/vuln_variant/fixed_P3_result.txt0.1 KB