New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification

Security firm FoxIO disclosed critical vulnerabilities in QPACK, the header compression mechanism used in HTTP/3, that allow unauthenticated remote attackers to crash web servers with a single connection. The attack exploits a memory amplification flaw where a small batch of compressed HTTP headers expands dramatically in memory, achieving up to 4,000-fold amplification. This can exhaust server memory on default configurations, effectively enabling denial-of-service attacks. Working proof-of-concept code has been released publicly. The vulnerability affects a wide range of HTTP/3 server implementations. No authentication or prior access is required to exploit the flaw. The disclosure highlights systemic risks in the QUIC/HTTP3 protocol stack's header compression design.