Starstruk Logo MarkStarstruk

app/v2.9.2

Ironclad/rivetapp/v2.9.2May 23, 2026by github-actions[bot]

AI Summary

This release highlights the addition of experimental Gecko obfuscation and a suite of security fixes addressing ACL bypasses, memory leaks, and protocol handling errors. It also includes validation improvements for outbound rules.

Key Highlights

  • Adds experimental Gecko obfuscation layer for QUIC packets
  • Fixes critical ACL bypass vulnerabilities via UDP packets and trailing domain dots
  • Resolves server OOM issues caused by oversized HTTP requests
  • Improves SOCKS5 UDP outbound and DoH resolver accuracy
  • Outbound rules now reject invalid port values

New Features

  • Gecko obfuscation
  • Minor performance improvements

Full Release Notes

> This release contains important security fixes and we strongly encourage everyone to upgrade.

- Added [Gecko obfuscation](https://hysteria.network/docs/advanced/Full-Server-Config/#__tabbed_2_2): a new experimental obfuscation layer that fragments QUIC handshake packets
- Fixed a security issue where UDP packets could bypass ACL
- Fixed a potential server OOM caused by incomplete or oversized HTTP requests during sniff
- Fixed an ACL bypass via trailing dots in domain names (e.g. `example.com.`)
- Fixed incorrect destination handling in the SOCKS5 UDP outbound
- Fixed `https://` prefix detection in the DoH resolver
- Outbound rules now reject invalid port values
- Minor performance improvements

---

> 此版本包含重要安全修复，强烈建议更新

- 新增 [Gecko](https://hysteria.network/docs/advanced/Full-Server-Config/#__tabbed_2_2)：一种实验性的新混淆实现，会对 QUIC 握手包进行分片处理
- 修复了 UDP 包可绕过 ACL 的安全问题
- 修复了启用 sniff 时，不完整或超大 HTTP 请求可能导致服务端 OOM 的问题
- 修复了通过在域名末尾添加点（如 `example.com.`）绕过 ACL 的问题
- 修复了 SOCKS5 UDP 出站中目标地址处理错误的问题
- 修复了 DoH 解析器对 `https://` 前缀的判断错误
- outbound 规则现在会拒绝无效端口号
- 小幅性能改进