Executive brief
Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF
Affected products
- Go github.com/apernet/hysteria/core/v2
Junglewise Threat Intelligence
Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF
Severity: low · CVSS 3.1 · Published 2026-06-26
Technologies: github.com/apernet/hysteria/core/v2 (Go). Vendors: Go.
Related threats
- GO-2026-5809 - Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF in github.com/apernet/hysteria/core
- apernet Hysteria UDP ACL bypass and SSRF
- GO-2026-5288 - Hysteria: A specially constructed quic package can crash the server OOM when the sniff is enabled in github.com/apernet/hysteria/core
- Hysteria: A specially constructed quic package can crash the server OOM when the sniff is enabled