New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
Summary: FoxIO disclosed QPACK flaws that let an unauthenticated remote attacker crash many HTTP/3 servers with a single connection, and released working proof-of-concept code. The affected stacks cap the compressed header batch arriving on the wire but not the unpacked result, or apply the cap too late, so a small batch can expand in memory; FoxIO found the flaw in seven of ten HTTP/3 stacks it tested, with fixes out for quic-go, Cloudflare quiche, lsquic and Wireshark while Bun, the h3 Rust library and aioquic were unpatched at disclosure.
What you should know: FoxIO measured about 4,000-fold memory amplification on Bun and 600 to 1,800 times on lsquic, and on Bun a single stream of about 516 KB leaves the server stuck at 100 percent CPU with no recovery. The stacks sit under Caddy, Traefik, cloudflared, LiteSpeed Web Server and OpenLiteSpeed, and because HTTP/3 runs over UDP the request reaches the server before much of the usual filtering applies.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026