Unauthenticated HTTP/3 flaws risk crashing servers via memory amplification
Remote attackers can crash HTTP/3 servers with single connections by exploiting header compression flaws, causing massive memory usage without needing login credentials.
Key points
- FoxIO disclosed QPACK flaws allowing remote denial-of-service via memory amplification.
- Fixes are available for quic-go, Cloudflare quiche, lsquic and Wireshark.
- Bun, h3 and aioquic remain unpatched at the time of disclosure.
Organisations running HTTP/3 web servers face immediate denial-of-service risks from newly disclosed flaws in the QPACK header compression scheme. Security firm FoxIO revealed that remote attackers can crash many servers using a single connection, forcing systems to consume thousands of times more memory than the incoming data requires. This impact affects infrastructure without requiring any user authentication or prior access.
What data or accounts are involved?
No user data, credentials or private accounts are involved in these specific vulnerabilities. The flaws cause only denial-of-service conditions, with no evidence of data theft or remote code execution. FoxIO stated there are no public reports of attacks occurring in the wild. The risk is purely to service availability, as the memory exhaustion can force default servers to stop responding to legitimate traffic.
Which software stacks are affected?
The issues stem from how HTTP/3 stacks handle header decompression. FoxIO found the same class of flaw in seven of the ten HTTP/3 stacks it tested. The affected libraries include quic-go, which underpins Caddy, Traefik and cloudflared, as well as lsquic used by LiteSpeed Web Server and OpenLiteSpeed. Bun’s HTTP/3 server also relies on lsquic. These stacks fail to cap the size of headers after unpacking them, allowing massive expansion.
What is the technical impact?
Attackers send small batches of compressed HTTP headers that expand significantly in server memory. On quic-go, a one megabyte batch unpacked into roughly 15 megabytes held in memory, representing a 17-fold increase. A second method using reference pointers drove the ratio much higher. FoxIO measured up to 4,000 times amplification on Bun and between 600 and 1,800 times on lsquic. This occurs because HTTP/3 runs over UDP, bypassing some standard filtering.
What is the patch status?
Fixes have been released for quic-go, Cloudflare quiche, lsquic and Wireshark. However, Bun, the h3 Rust library and aioquic were still unpatched at the time of disclosure. FoxIO noted that IIS, Envoy, ngtcp2/nghttp3 and Google’s quiche are not affected because they cap unpacked headers during decoding. Organisations using the unpatched libraries remain exposed to these memory exhaustion attacks until vendors provide updates.
What affected people can do
Teams should immediately audit their server infrastructure to identify any reliance on the affected HTTP/3 libraries, particularly quic-go, lsquic, Bun, h3 and aioquic. For those using patched stacks, ensure the latest versions are deployed. Monitor server memory usage for unusual spikes that could indicate exploitation attempts. Be vigilant for follow-up phishing scams claiming to offer fixes or support for this issue, verifying all communications through official vendor channels before taking action.
What to do and how to stay safe: FoxIO
- Verify current versions of HTTP/3 libraries against vendor advisories to confirm patch status.
- Monitor server resource metrics for abnormal memory consumption patterns indicative of attacks.
- Restrict HTTP/3 access at the network perimeter if immediate patching is not possible.
- Educate staff to ignore unsolicited messages offering emergency fixes for this vulnerability.
Step-by-step guide: Spot Business Email Compromise: Hidden Signs and Immediate Response
General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are any user credentials or personal data at risk from these QPACK flaws?
No, the vulnerabilities only cause denial-of-service conditions with no evidence of data theft or code execution.
Which HTTP/3 stacks are confirmed to be unaffected by these issues?
IIS, Envoy, ngtcp2/nghttp3 and Google’s quiche are not affected as they cap unpacked headers correctly.
Is there proof that these flaws are being exploited in the wild?
No, FoxIO stated there are no public reports of attacks in the wild at the time of disclosure.
