Junglewise Threat Intelligence

GO-2026-5809 - Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF in github.com/apernet/hysteria/core

Severity: info · Published 2026-07-07

Technologies: github.com/apernet/hysteria/core/v2 (Go). Vendors: Go.

Executive brief

Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF in github.com/apernet/hysteria/core

Affected products

  • Go github.com/apernet/hysteria/core
  • Go github.com/apernet/hysteria/core/v2

Related threats