Examples / Report #3125832 Saved analysis

HTTP/3 Stream Dependency Cycle Exploit

curl · 2025-05-0419.0s analysis · $0.015 in model calls

What the report claims

A stream dependency cycle exploit in HTTP/3 causes memory corruption and potential remote code execution in curl 8.13.0.

Compare with curl's recorded outcome

Labeled AI slop

curl's maintainer lists this report as AI slop

Shown for comparison after analysis. The pipeline did not see this label.

ProveIt's finding

Needs human review

The available evidence does not settle the report. A maintainer should investigate.

curl policy: NULL dereferences and crashes

Judgment withdrawn. The answer failed the evidence check.

See the withdrawn model reasoning

The following reasoning failed the citation check and does not support the final finding.

The crash occurs in ngtcp2 (ngtcp2_http3_handle_priority_frame), a separate library, not in curl's own code
The malicious server violates RFC 9218 by sending PRIORITY_UPDATE frames which servers MUST NOT send
HTTP/3 support in curl is experimental and off by default, falling under 'Debug & Experiments' policy exclusion
Project policy explicitly states crashes from malicious servers are not security problems unless special circumstances exist
No curl source code was provided to verify any flaw in curl's implementation

What still needs checking

curl's HTTP/3 priority frame handling code (ngtcp2 integration)
Whether curl validates PRIORITY_UPDATE frame sender per RFC 9218
Whether cyclic dependency detection exists in curl's ngtcp2 usage

How this analysis ran 6 claims · 0 citations verified

Evidence check: judge quoted an external source that does not say that (https://www.rfc-editor.org/info/rfc9218)

Checked against curl master on 2025-05-04 (e1f87a093b71). Test evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.

1 · Grounding

grounded

no model · 2 references checked out, 0 did not

2 · Claims

NVIDIA-Nemotron-3-Nano-30B-A3B

6 claims · 2573 tokens · $0.0003

3 · Evidence

0 code snippets

real curl source at e1f87a093b71 · 6 docs via Tavily

4 · Judgment

Nemotron-3-Ultra-550b-a55b

10543 tokens · 8.3s · $0.0152

5 · Receipts

0 of 3 citations verified

every citation must point at code the judge was shown

Inspect the withdrawn draft reply

This draft belongs to the withdrawn judgment. It may contain unsupported claims.

Thank you for the detailed report. However, this does not qualify as a security vulnerability in curl per our policy: (1) The crash occurs in ngtcp2, a separate library; (2) Your malicious server violates RFC 9218 by sending PRIORITY_UPDATE frames which servers MUST NOT send; (3) HTTP/3 is experimental and off by default in curl; (4) Our policy excludes crashes from malicious servers and experimental features. We do not consider this a security issue in curl.

Inspect all claims and source code 6 claims · 0 code excerpts

This model judgment was withdrawn. The claim assessments below are preserved for inspection and may be wrong.

Report claims

C1flaw not verifiable

send_cyclic_priority creates a cyclic dependency between stream 3 and 7

Read the reasoning

This claim describes behavior in the malicious server (aioquic), not in curl. The send_cyclic_priority function is part of the attacker's proof-of-concept server code, not curl's codebase. No curl code was provided to assess.

C2location not verifiable

in aioquic/quic/connection.py

Read the reasoning

The location aioquic/quic/connection.py is in the attacker's server implementation, not in curl. The deterministic checks confirm curl exists at the revision but no curl source files were provided for analysis.

C3trigger not verifiable

sending TRIGGER_MEMORY_CORRUPTION data on stream 3

Read the reasoning

The trigger describes the attacker's server sending data on stream 3. This is an action by the malicious server, not a code path in curl. Without curl's HTTP/3 priority frame handling code, the claim cannot be verified against curl's implementation.

C4impact contradicted

segmentation fault and potential remote code execution

Read the reasoning

The crash occurs in ngtcp2_http3_handle_priority_frame (ngtcp2 library), not curl proper. The malicious server violates RFC 9218 by sending PRIORITY_UPDATE frames (servers MUST NOT send them). HTTP/3 support in curl is experimental and off by default. Per project policy, crashes triggered by malicious servers are not considered security problems, and experimental features are excluded.

project_policy:0 project_policy:0 E2:0

C5reproduction not verifiable

run exploit_server.py then curl --http3-only https://localhost:4433

Read the reasoning

Reproduction steps require the malicious aioquic server and curl with --http3-only. Without curl's HTTP/3 handling code, the code path from network input to crash cannot be verified in curl's codebase.

C6reproduction not verifiable

ulimit -c unlimited and ./launch_attack.sh

Read the reasoning

Same as C5 - reproduction depends on external server and experimental curl feature. No curl source code provided to confirm the vulnerability exists in curl's implementation.

What the report says about other projects

confirmed Servers MUST NOT send PRIORITY_UPDATE frames; clients receiving them MUST respond with PROTOCOL_ERROR

“Servers MUST NOT send PRIORITY_UPDATE frames. If a client receives a PRIORITY_UPDATE frame, it MUST respond with a connection error of type PROTOCOL_ERROR.” source

confirmed HTTP/3 priority scheme forms a dependency tree; cyclic dependencies would violate the tree structure

“Taken together, the dependencies across all requests in a connection form a dependency tree.” source

Read the original report (excerpt)

Full report on HackerOne ↗

**Penetration Testing Report: HTTP/3 Stream Dependency Cycle Exploit** --- # **0x00 Overview** A novel exploit leveraging stream dependency cycles in the HTTP/3 protocol stack was discovered, resulting in memory corruption and potential denial-of-service or remote code execution scenarios when used against HTTP/3-capable clients such as `curl` (tested on version 8.13.0). This report details a practical proof of concept, required environment setup, attack execution, and crash analysis. --- # **0x01 Environment Setup** ## **1. Malicious Server Setup (aioquic modified)** ```bash # Clone aioquic git clone https://github.com/aiortc/aioquic/ cd aioquic # Apply patch to enable cyclic stream dependency injection cat << 'EOF' > cycle_patch.diff diff --git a/aioquic/quic/connection.py b/aioquic/quic/connection.py index 1a2b3c4..d4e5f6a 100644 --- a/aioquic/quic/connection.py +++ b/aioquic/quic/connection.py @@ -1233,6 +1233,15 @@ class QuicConnection: self._logger.debug("Sending PRIORITY_UPDATE frame (stream_id=%d)", stream_id) self._quic.send_stream_data(stream_id, frame.serialize(), end_stream=False) + def send_cyclic_priority(self, stream_a: int, stream_b: int): + from aioquic.quic.frames import PriorityUpdateFrame + self.send_priority_update(stream_a, depends_on=stream_b, weight=256) + self.send_priority_update(stream_b, depends_on=stream_a, weight=256) + self._logger.critical("CYCLIC PRIORITY INJECTED: %d <-> %d", stream_a, stream_b) EOF # Apply and install git apply cycle_patch.diff pip install -e . ``` --- # **0x02 Proof-of-Concept Code** ## **1. Malicious HTTP/3 Server (exploit\_server.py)** ```python import asyncio from aioquic.asyncio import QuicConnectionProtocol, serve from aioquic.quic.configuration import QuicConfiguration class ExploitServer(QuicConnectionProtocol): async def on_stream_data(self, stream_id: int, data: bytes): if stream_id == 0: # Control stream # Phase 1: Heap shaping - open 100 streams for i in range(1, 100, 2): self._quic.send_headers( stream_id=i, headers=[(b":status", b"200"), (b"content-type", b"text/html")] ) self._quic.send_stream_data(i, b"A" * 65535) # Phase 2: Inject cyclic dependency between stream 3 and 7 self._qu …

Source code

No source code was retrieved for this analysis. The evidence may be incomplete.