Rust crates and libraries. Newest first.
A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation.
Signal (RingRTC calling library, @signalapp/ringrtc)Closed Oct 22, 2026
FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.
HTTP/3 / QPACK stacks (quic-go, Cloudflare quiche, lsquic, Bun, aioquic, h3, Wireshark, …)Since Oct 20, 2026
HTTP/3 servers using QPACK are exposed to serious memory-amplification flaws. Attackers can crash servers with tiny compressed headers. Key stacks like quic-go, quiche, lsquic patched—but Bun, h3, aioquic still vulnerable. Mitigations needed now. #HTTP3 #QPACK #Vulnerability t.co/ZU7h7ky0XX
HTTP/3サーバ向けのDoS攻撃手法、QPACK増幅攻撃"Header Accordions"のPoC（攻撃の概念実証コード）と詳細が開示された。quic-go、Cloudflare quiche、Wiresharkは修正済み。Microsoft IIS、Envoy、Google quiche、ngtcp2/nghttp3は元々脆弱ではない。 t.co/iIRxIHmhnu
QUICの多くの実装でのOOM "Header Accordions: QPACK amplification attacks against HTTP/3 servers - FoxIO | Cyber Innovation" t.co/qEjI9cftas
CVE-2026-113380 affects RingRTC versions before 2.72.0 and could let a call participant keep hearing audio after hang-up. No in-the-wild exploitation is known; users are advised to update Signal.
📵 Update Signal. A critical flaw in its RingRTC calling library could stop a call ending when you hang up, leaving audio and perhaps video running, per its CVE record. RingRTC 2.72.0 fixes it. There's no report of exploitation. Source: CVE-2026-113380 record
