New QPACK Flaws Allow Remote HTTP/3 Server Crashes and Memory Amplification

Discovery of QPACK Vulnerabilities

Security firm FoxIO has revealed critical flaws in the QPACK compression scheme used by HTTP/3, enabling remote, unauthenticated attackers to trigger denial-of-service attacks. The firm released proof-of-concept code demonstrating how a single connection can crash vulnerable HTTP/3 web servers.

Mechanism of Attack

The vulnerabilities stem from how HTTP/3 stacks handle compressed HTTP headers. Attackers send a small batch of compressed headers that, when unpacked, expand into a much larger data set, forcing the server to consume significantly more memory than received. This memory amplification can reach up to 4,000 times the original input, leading to out-of-memory conditions and server crashes.

The core issue lies in the QPACK implementation, where affected stacks either fail to cap the size of unpacked headers or apply the cap too late in the decoding process. This allows a single request to generate hundreds of thousands of header entries held in server memory.

Affected Systems and Patches

FoxIO identified these flaws in seven out of ten HTTP/3 stacks tested. Patches have been released for quic-go, Cloudflare quiche, lsquic, and Wireshark. However, Bun, the h3 Rust library, and aioquic remained unpatched at the time of disclosure. IIS, Envoy, ngtcp2/nghttp3, and Google's quiche were not affected due to proper header capping during decoding.

The impact is broad, as these vulnerable stacks underpin common software. For example, quic-go is used by Caddy, Traefik, and cloudflared, while lsquic is integral to LiteSpeed Web Server, OpenLiteSpeed, and Bun's HTTP/3 server.

Attack Vector and Impact

Attackers do not require an account or special access to exploit these vulnerabilities. Since HTTP/3 operates over UDP, requests can reach the server before many standard filtering mechanisms are applied. The attacks are limited to denial-of-service, with no evidence of data theft or code execution, and no public reports of in-the-wild exploitation.