{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T12:59:41.857Z",
  "stack": {
    "id": "rust",
    "label": "Rust",
    "kind": "language",
    "url": "https://pwn.watch/s/rust",
    "feed": "https://pwn.watch/s/rust/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 2,
    "notFullyPatched": 1,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "signal-ringrtc-cve-2026-113380",
      "title": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380",
      "json": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Signal (RingRTC calling library, @signalapp/ringrtc)",
      "stacks": [
        "rust",
        "npm"
      ],
      "cveIds": [
        "CVE-2026-113380"
      ],
      "affectedVersions": [
        "RingRTC before 2.72.0 (Signal Android, iOS and Desktop clients embedding it)"
      ],
      "fixedVersions": [
        "RingRTC 2.72.0 (update Signal on every device)"
      ],
      "startedAt": "2026-10-20",
      "closedAt": null,
      "updatedAt": "2026-10-22T14:44:48+02:00",
      "summary": "A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation."
    },
    {
      "slug": "http3-qpack-header-accordions",
      "title": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS",
      "url": "https://pwn.watch/i/http3-qpack-header-accordions",
      "json": "https://pwn.watch/i/http3-qpack-header-accordions.json",
      "status": "live",
      "severity": "unknown",
      "patchStatus": "partial",
      "product": "HTTP/3 / QPACK stacks (quic-go, Cloudflare quiche, lsquic, Bun, aioquic, h3, Wireshark, …)",
      "stacks": [
        "go",
        "rust",
        "python"
      ],
      "cveIds": [
        "CVE-2025-64702",
        "CVE-2026-12523",
        "CVE-2025-13945"
      ],
      "affectedVersions": [
        "See FoxIO table; Bun 1.4.3 and aioquic/mitmproxy unpatched as of Oct 20 2026"
      ],
      "fixedVersions": [
        "quic-go 0.57.0",
        "Cloudflare quiche 0.29.3",
        "lsquic 4.9.0",
        "Wireshark 4.6.2 / 4.4.12"
      ],
      "startedAt": "2026-10-20",
      "closedAt": null,
      "updatedAt": "2026-10-22T11:19:00+02:00",
      "summary": "FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication."
    }
  ],
  "changes": [
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "No known exploitation; CISA has not added it to KEV and NVD lists it as awaiting analysis.",
      "body": null,
      "sourceUrl": "https://www.helpnetsecurity.com/2026/10/22/signal-ringrtc-vulnerability-cve-2026-113380/",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "SecurityWeek: the hang-up was queued behind peer events with no rate limit or priority; the fix makes call termination bypass the queue. Users should update Signal and check the call indicator after hanging up.",
      "body": null,
      "sourceUrl": "https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "Researcher Imahian's write-up and conceptual PoC circulate; press coverage begins.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-20",
      "title": "CVE-2026-113380 published by MITRE (CVSS 4.0 9.3); fix is RingRTC 2.72.0.",
      "body": null,
      "sourceUrl": "https://www.cve.org/CVERecord?id=CVE-2026-113380",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "http3-qpack-header-accordions",
      "incidentTitle": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS",
      "severity": "unknown",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-20",
      "title": "FoxIO blog + PoC published; several stacks still unpatched.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/http3-qpack-header-accordions"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-09-04",
      "title": "Signal quietly fixes the bug in RingRTC 2.72.0 (commit \"Ensure calls terminate completely in corner cases\"), about six weeks before disclosure.",
      "body": null,
      "sourceUrl": "https://github.com/signalapp/ringrtc/commit/4b1b6fa53c9f30c87c8ea78e44675d4a13e1e4d3",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "http3-qpack-header-accordions",
      "incidentTitle": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS",
      "severity": "unknown",
      "status": "live",
      "patchStatus": "partial",
      "date": "2025-11 → 2026-07",
      "title": "Responsible reports to quic-go, quiche, Bun, aioquic, lsquic, h3.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/http3-qpack-header-accordions"
    }
  ]
}