apernet Hysteria Denial of Service in HTTP sniffing

Executive brief

Hysteria is a popular network proxy tool. A vulnerability in its protocol sniffing feature allows an attacker to crash the server or cause it to run out of memory by sending specially crafted, excessively large HTTP headers. This can lead to a total service outage for all users connected to the proxy.

Technical details

The vulnerability exists in the 'sniff' implementation of the Hysteria server. When protocol sniffing is enabled, the server attempts to identify the protocol of incoming connections. However, it does not enforce a maximum size limit for HTTP headers. An attacker can establish a connection and continuously stream large amounts of header data without the terminating CRLF sequence. This causes the server to buffer the data indefinitely until it exhausts available system memory (OOM), resulting in a Denial of Service. The issue is fixed in version 2.9.2.

Affected products

• apernet Hysteria < 2.9.2

Timeline

• 2026-05-23: disclosed
• 2026-06-26: advisory: GitHub Advisory published
• 2026-06-26: patched: Version 2.9.2 released

References

• https://api.github.com/users/Cherrling
• https://github.com/Cherrling
• https://api.github.com/users/Cherrling/gists%7B/gist_id%7D
• https://api.github.com/users/Cherrling/repos
• https://avatars.githubusercontent.com/u/37233261?v=4
• https://api.github.com/users/Cherrling/events%7B/privacy%7D