New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
A newly disclosed QPACK flaw enables unauthenticated attackers to crash HTTP/3 servers via 4,000× memory amplification with a single connection — PoC code is already public, making mitigation urgent for any organisation serving QUIC traffic.
Summary written by editorial AI · Source link below
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code.
By sending a small batch of compressed HTTP headers that expands in memory to a much larger set, the attacker can force the server to use thousands of times more memory than it received, enough to run a default server
Editorial Analysis
Public proof-of-concept code for a high-amplification DoS against a widely adopted protocol layer means exploitation at scale is days, not weeks, away.
Identify all HTTP/3-enabled endpoints and either apply vendor patches, limit QPACK dynamic table size, or temporarily fall back to HTTP/2.
A new protocol-level flaw can crash modern web servers with minimal effort — public-facing services using HTTP/3 need immediate review.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at THN (Feedburner) in a new tab.
More from the Vulnerabilities Desk
- Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers1d
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software2d
- Abandoned Popcorn Time app exposed millions of devices to RCE attacks3d
- HPE patches eight max severity RCE and auth bypass AOS flaws3d
- Compromised TLS Certificates3d