/
← Voltar ao feed
high

FoxIO discloses QPACK flaws letting one HTTP/3 connection crash servers via up to 4,000x memory amplification

1 fonte(s) · 1 atualização(ões) · publicado 22/10/2026 03:38 · coletado há 6 horas

FoxIO disclosed a class of denial-of-service flaws in the QPACK header compression used by HTTP/3. It affects seven of the ten stacks the firm tested and was released with working proof-of-concept code. An unauthenticated remote attacker can send a small compressed header batch that expands in memory by thousands of times, exhausting a default server's memory with a single connection. There is no evidence of data theft or code execution and no public reports of in-the-wild attacks. Fixes exist for quic-go, Cloudflare quiche, lsquic and Wireshark, but Bun, the h3 Rust library and aioquic were unpatched at disclosure.

Entenda a falha

A vulnerabilidade

FoxIO disclosed a class of denial-of-service flaws in QPACK, the HTTP/3 header compression, found in seven of ten stacks tested. No CVEs are listed. An unauthenticated remote attacker needs only network reach over UDP and one connection. A small compressed header batch expands in memory by thousands of times and can exhaust a default server's memory. Affected: quic-go (behind Caddy, Traefik, cloudflared), Cloudflare quiche, lsquic (LiteSpeed Web Server, OpenLiteSpeed), Bun, the h3 Rust library, aioquic and mitmproxy. Fixes exist for quic-go, quiche, lsquic and Wireshark; Bun, h3 and aioquic were unpatched at disclosure. Bun is the worst case: its experimental server can get stuck at 100% CPU. Wireshark's dissector crash is separate and not network-reachable. IIS, Envoy, ngtcp2/nghttp3 and Google's quiche are not affected.

Como funciona

A client sends a request whose headers are QPACK-compressed, so repeated fields travel as short codes. The server's HTTP/3 stack decodes them into full header entries held in memory for the request. The size limit applies to the compressed batch on the wire, not to the unpacked result, or it applies too late. One request can therefore become hundreds of thousands of header entries. A second method stores one roughly 4 KB entry and references it thousands of times with one-byte references, and the server rebuilds the full entry each time. In Bun, once unpacked headers pass 2 GB, a size counter overflows to zero and the server enters an endless loop.

Por que é vulnerável

The root cause is a missing or late limit on unpacked header size: the affected stacks cap the compressed input but not the expanded output. This lets a small input drive large memory allocation. On Bun, the code replaces lsquic's header-memory cap with its own, which checks each header but never the running total, so the 2 GB counter overflow becomes reachable; lsquic's own 64 KB cap prevents it. The unaffected stacks cap unpacked headers during decoding. The lsquic fix caps how many unpacked header sets are held per stream, defaulting to one.

Onde está

The articles name no file, function or commit; they only point to the header-size cap in QPACK decoding, Bun's own replacement of lsquic's header-memory cap, the lsquic fix released July 16, 2026, and the h3 setting max_field_section_size.

Como foi descoberta

FoxIO found the flaws while testing ten HTTP/3 stacks. The work began after Gal Bar Nahum's research into MadeYouReset, an HTTP/2 denial-of-service technique, which raised the question of whether HTTP/3's header compression had a similar weakness. FoxIO disclosed the findings publicly with proof-of-concept code on or before October 22, 2026. The articles report no attacks in the wild and do not describe the reporting timeline per vendor.

PoC pública

FoxIO released working proof-of-concept code with the disclosure, but the articles give no repository address. It demonstrates the memory amplification on the tested stacks (about 17x on quic-go, 600-1,800x on lsquic, about 4,000x on Bun) and the Bun hang from a single stream of about 516 KB. It is a working denial-of-service demonstration, not code execution. Because it is public and needs only one unauthenticated connection, patching or mitigating the unfixed stacks is urgent.

Explicação gerada por IA a partir da matéria e dos artigos, em 22/10/2026 08:16.

Detalhes técnicos

  • Root cause: affected stacks cap the compressed batch on the wire but not the unpacked header size, or apply the cap too late. One request can therefore expand into hundreds of thousands of header entries held in memory.
  • Amplification: on quic-go, a 1 MB batch unpacks into about 160,000 fields and roughly 15 MB held (about 17x). quic-go's own advisory puts the possible expansion at around 50x. A second method stores one ~4 KB header entry and references it thousands of times with one-byte references. FoxIO measured about 4,000x on Bun and 600-1,800x on lsquic.
  • Bun worst case: its experimental HTTP/3 server uses lsquic but replaces the header-memory cap with its own code, which checks each header but not the running total. Once unpacked headers pass 2 GB, a size counter overflows to zero and the server enters an endless loop. A single stream of about 516 KB leaves it at 100% CPU with no recovery. lsquic's own 64 KB cap prevents this.
  • Reach: quic-go underpins Caddy, Traefik and cloudflared. lsquic underpins LiteSpeed Web Server, OpenLiteSpeed and Bun's HTTP/3 server. HTTP/3 runs over UDP, so requests reach the server before much of the usual filtering applies.
  • Wireshark: a different case. The HTTP/3 dissector crashes when decrypting with a key-log file or opening a capture containing decryption secrets. It is not network-reachable, and Wireshark says it knows of no exploits.
  • Not affected: IIS, Envoy, ngtcp2/nghttp3 and Google's quiche, because they cap unpacked headers during decoding.
  • Origin: the work began after Gal Bar Nahum's research into "MadeYouReset", an HTTP/2 DoS technique.

Remediação

  • Upgrade to the fixed releases. The lsquic fix, released July 16, 2026, caps unpacked header sets held per stream, defaulting to one.
  • Bun: do not expose an HTTP/3 server.
  • mitmproxy: disable HTTP/3 with --set http3=false.
  • h3 Rust library: set a sensible max_field_section_size.

Linha do tempo

  1. thehackernews.com ↗ · pub. 22/10/2026 03:38 · coletado 22/10 08:00 primeiro registro

    FoxIO discloses QPACK flaws letting one HTTP/3 connection crash servers via up to 4,000x memory amplification

    ler a análise desta fonte

    FoxIO disclosed a class of denial-of-service flaws in the QPACK header compression used by HTTP/3. It affects seven of the ten stacks the firm tested and was released with working proof-of-concept code. An unauthenticated remote attacker can send a small compressed header batch that expands in memory by thousands of times, exhausting a default server's memory with a single connection. There is no evidence of data theft or code execution and no public reports of in-the-wild attacks. Fixes exist for quic-go, Cloudflare quiche, lsquic and Wireshark, but Bun, the h3 Rust library and aioquic were unpatched at disclosure.

    Technical Details

    • Root cause: affected stacks cap the compressed batch on the wire but not the unpacked header size, or apply the cap too late. One request can therefore expand into hundreds of thousands of header entries held in memory.
    • Amplification: on quic-go, a 1 MB batch unpacks into about 160,000 fields and roughly 15 MB held (about 17x). quic-go's own advisory puts the possible expansion at around 50x. A second method stores one ~4 KB header entry and references it thousands of times with one-byte references. FoxIO measured about 4,000x on Bun and 600-1,800x on lsquic.
    • Bun worst case: its experimental HTTP/3 server uses lsquic but replaces the header-memory cap with its own code, which checks each header but not the running total. Once unpacked headers pass 2 GB, a size counter overflows to zero and the server enters an endless loop. A single stream of about 516 KB leaves it at 100% CPU with no recovery. lsquic's own 64 KB cap prevents this.
    • Reach: quic-go underpins Caddy, Traefik and cloudflared. lsquic underpins LiteSpeed Web Server, OpenLiteSpeed and Bun's HTTP/3 server. HTTP/3 runs over UDP, so requests reach the server before much of the usual filtering applies.
    • Wireshark: a different case. The HTTP/3 dissector crashes when decrypting with a key-log file or opening a capture containing decryption secrets. It is not network-reachable, and Wireshark says it knows of no exploits.
    • Not affected: IIS, Envoy, ngtcp2/nghttp3 and Google's quiche, because they cap unpacked headers during decoding.
    • Origin: the work began after Gal Bar Nahum's research into "MadeYouReset", an HTTP/2 DoS technique.

    Remediation

    • Upgrade to the fixed releases. The lsquic fix, released July 16, 2026, caps unpacked header sets held per stream, defaulting to one.
    • Bun: do not expose an HTTP/3 server.
    • mitmproxy: disable HTTP/3 with --set http3=false.
    • h3 Rust library: set a sensible max_field_section_size.