thehackernews.com
Oct 22, 2026
New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
AI-summarised brief · reviewed before publication
Security firm FoxIO revealed that a remote attacker can crash HTTP/3 servers by sending a small batch of compressed headers that expands into thousands of times more memory, causing a denial‑of‑service. The flaw, rooted in QPACK’s header‑compression handling, affects several popular stacks, including quic-go, Cloudflare quiche, lsquic, and Wireshark, while Bun, the h3 Rust library, and aioquic remain unpatched. FoxIO’s proof‑of‑concept code demonstrates up to 4,000‑fold memory amplification, and fixes are already available for most libraries.
💡 Why It Matters
- · The vulnerability exposes a critical weakness in the core of HTTP/3’s header compression, enabling attackers to exhaust server resources without authentication.
- · Prompt patching is essential to maintain the reliability and security of the next‑generation web protocol.
