Vulnerabilities
QPACK flaws let attackers crash HTTP/3 servers with memory overload
Researchers found flaws in HTTP/3's QPACK header compression that let attackers crash servers by sending small requests that use up huge amounts of memory. Some major HTTP/3 libraries have released fixes, but others remain unpatched.
Ross GrantUpdated 2 min read
The short version
Researchers found a problem in the way some web servers handle compressed data in HTTP/3. Attackers can send a small request that makes the server use a huge amount of memory, causing it to crash. This only lets attackers take servers offline, not steal data. Some software has been fixed, but others still need updates.
By the numbers
- 4,000-foldmaximum memory amplification measured by FoxIOThe Hacker News
- 7 of 10HTTP/3 stacks tested found vulnerable by FoxIOThe Hacker News
- 1 MB to 160,000 fieldsexample: 1 MB compressed batch unpacked to about 160,000 header fieldsThe Hacker News
What happened?
Researchers at FoxIO disclosed flaws in HTTP/3's QPACK header compression that let remote attackers crash web servers by sending small, specially crafted requests. The flaws cause servers to use up to 4,000 times more memory than the original request, leading to denial-of-service. Fixes are available for some libraries, but others remain unpatched. There is no evidence of data theft or real-world attacks so far.
How the flaw works
According to The Hacker News (opens in a new tab), security firm FoxIO has disclosed flaws in QPACK, the header compression system used by HTTP/3. The flaws let a remote attacker (without needing to log in) crash many HTTP/3 web servers by sending a specially crafted batch of compressed HTTP headers. When the server unpacks these headers, they expand in memory to a much larger size than the original request, causing the server to use up thousands of times more memory than it received. This can run a default server out of memory, leading to a denial-of-service (DoS) condition.
The root cause is that some HTTP/3 software libraries cap the size of the compressed headers as they arrive, but fail to cap the size of the headers after they are unpacked. In some cases, the cap is applied too late. This means a single small request can expand into hundreds of thousands of header entries, all held in memory.
Who is affected
FoxIO found this class of flaw in seven out of ten HTTP/3 stacks it tested. Libraries affected include quic-go (used by Caddy, Traefik, and cloudflared), Cloudflare quiche, lsquic (used in LiteSpeed Web Server and OpenLiteSpeed), Bun's HTTP/3 server, h3 Rust library, aioquic, and Wireshark. Some stacks, such as IIS, Envoy, ngtcp2/nghttp3, and Google's quiche, are not affected because they cap the unpacked headers during decoding.
What was taken
There is no evidence of data theft or code execution. The flaw only allows denial-of-service attacks, which can crash or freeze affected servers.
Is there a fix?
Fixes are available for quic-go, Cloudflare quiche, lsquic, and Wireshark. As of the disclosure, Bun, the h3 Rust library, and aioquic were still unpatched. FoxIO recommends not exposing Bun's HTTP/3 server, disabling HTTP/3 in mitmproxy, and setting a sensible header size limit in the h3 Rust library until fixes are released.
The response
FoxIO released proof-of-concept code to demonstrate the issue. The lsquic fix, released on 16 July 2026, caps the number of unpacked header sets a server holds per stream. Wireshark's fix addresses a related issue in its HTTP/3 dissector, which could crash when opening certain capture files, but Wireshark says it is unaware of any real-world exploits.
What you should do
Operators using affected HTTP/3 stacks should upgrade to the latest fixed versions. If a fix is not yet available, consider disabling HTTP/3 or applying the recommended workarounds to limit the risk of denial-of-service attacks.
Why it matters
Many popular web servers use HTTP/3 libraries that are affected by this flaw. Attackers do not need an account or special access to exploit it, so exposed servers are at risk of being taken offline until patched.
Key points
- QPACK flaws in HTTP/3 can let attackers crash servers with small requests.
- The attack causes servers to use thousands of times more memory than normal.
- No data theft or code execution is possible, only denial-of-service.
- Fixes are out for some libraries, but others remain unpatched.
- Operators should upgrade or apply workarounds to reduce risk.
Sources
The Hacker News
Reference
