Vulnerability & Exploit · thehackernews.com

QPACK Flaws Enable HTTP/3 Server Crashes and Up to 4,000× Memory Amplification

Oct 22, 2026 · Original article ↗

Summary

FoxIO disclosed QPACK flaws affecting 7 of 10 tested HTTP/3 stacks. Unauthenticated requests can cause denial of service through memory amplification; fixes and interim mitigations vary by implementation.

Key points

FoxIO found the same QPACK flaw class in 7 of 10 HTTP/3 stacks tested: compressed headers can expand substantially without an effective cap on unpacked size.
An unauthenticated attacker can send a small compressed header batch that consumes far more server memory and may cause denial of service; no data theft, code execution, or in-the-wild attacks were reported.
FoxIO measured memory amplification of about 4,000× on Bun and 600–1,800× on lsquic using repeated references to a stored header.
In Bun, FoxIO reported that header-size counter overflow after unpacked headers exceed 2 GB can cause an unrecoverable 100% CPU loop, blocking new requests.
Fixes were available for quic-go, Cloudflare quiche, lsquic, and Wireshark; Bun, the h3 Rust library, and aioquic were still unpatched at disclosure.
FoxIO said IIS, Envoy, ngtcp2/nghttp3, and Google's quiche were not affected because they limit unpacked headers during decoding.
Recommended interim steps include not exposing Bun's HTTP/3 server, disabling HTTP/3 in mitmproxy, and setting max_field_section_size for the h3 Rust library.

Article Details

Vulnerability Types: HTTP/3 QPACK header decompression memory-amplification denial of service
Integer overflow causing an infinite loop and CPU denial of service
Severity: The flaws can cause denial of service; FoxIO measured up to 4,000-fold memory amplification on Bun. No data theft or code execution was reported.
Exploitation Status: not_reported
Exploit Availability: public_poc
Patch Status: partial
Workarounds: On Bun, do not expose an HTTP/3 server.
On mitmproxy, disable HTTP/3 with --set http3=false.
For the h3 Rust library, set a sensible limit with max_field_section_size.

People

Gal Bar NahumHis research into the MadeYouReset denial-of-service technique prompted FoxIO to investigate whether HTTP/3 header compression had a similar weakness.

Vendors

FoxIOA remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code.

Products

aioquicFixes are out for quic-go, Cloudflare quiche, lsquic and Wireshark, but Bun, the h3 Rust library and aioquic were still unpatched at disclosure.Bunreports of attacks in the wild. Fixes are out for quic-go, Cloudflare quiche, lsquic and Wireshark, but Bun, the h3 Rust library and aioquic were still unpatched at disclosure.CaddyThe reach is wide because these stacks sit under common software. quic-go is the Go library behind Caddy, Traefik and cloudflared; lsquic is LiteSpeed's library, used in LiteSpeed Web Server and OpenLiteSpeed; and Bun's Cloudflare quichetheft or code execution and no public reports of attacks in the wild. Fixes are out for quic-go, Cloudflare quiche, lsquic and Wireshark, but Bun, the h3 Rust library and aioquic were still unpatched at disclosure.Cloudflaredbecause these stacks sit under common software. quic-go is the Go library behind Caddy, Traefik and cloudflared; lsquic is LiteSpeed's library, used in LiteSpeed Web Server and OpenLiteSpeed; and Bun's HTTP/3 server EnvoyFoxIO lists IIS, Envoy, ngtcp2/nghttp3, and Google's quiche as not affected, each because it caps the unpacked headers while decoding rather than after.h3 Rust libraryin the wild. Fixes are out for quic-go, Cloudflare quiche, lsquic and Wireshark, but Bun, the h3 Rust library and aioquic were still unpatched at disclosure.IISFoxIO lists IIS, Envoy, ngtcp2/nghttp3, and Google's quiche as not affected, each because it caps the unpacked headers while decoding rather than after.LiteSpeed Web Serveris the Go library behind Caddy, Traefik and cloudflared; lsquic is LiteSpeed's library, used in LiteSpeed Web Server and OpenLiteSpeed; and Bun's HTTP/3 server runs on lsquic.lsquicexecution and no public reports of attacks in the wild. Fixes are out for quic-go, Cloudflare quiche, lsquic and Wireshark, but Bun, the h3 Rust library and aioquic were still unpatched at disclosure.mitmproxyFor the stacks with no fix, FoxIO gives interim steps: on Bun, do not expose an HTTP/3 server; on mitmproxy, turn off HTTP/3 by passing --set http3=false; and for the h3 Rust library, set a sensible limit with ngtcp2/nghttp3FoxIO lists IIS, Envoy, ngtcp2/nghttp3, and Google's quiche as not affected, each because it caps the unpacked headers while decoding rather than after.OpenLiteSpeedCaddy, Traefik and cloudflared; lsquic is LiteSpeed's library, used in LiteSpeed Web Server and OpenLiteSpeed; and Bun's HTTP/3 server runs on lsquic.quic-goevidence of data theft or code execution and no public reports of attacks in the wild. Fixes are out for quic-go, Cloudflare quiche, lsquic and Wireshark, but Bun, the h3 Rust library and aioquic were still unpatched Traefik ProxyThe reach is wide because these stacks sit under common software. quic-go is the Go library behind Caddy, Traefik and cloudflared; lsquic is LiteSpeed's library, used in LiteSpeed Web Server and OpenLiteSpeed; and Bun's Wiresharkand no public reports of attacks in the wild. Fixes are out for quic-go, Cloudflare quiche, lsquic and Wireshark, but Bun, the h3 Rust library and aioquic were still unpatched at disclosure.