QPACK flaws can crash HTTP/3 servers, FoxIO says

Past-week coverage · Original source published 2026-10-22.

Security firm FoxIO disclosed flaws in QPACK, the header compression scheme used by HTTP/3, that it says let a remote attacker who has not logged in crash many HTTP/3 web servers with a single connection. The company also released working proof-of-concept code.

According to the disclosure, the attack works by sending a small batch of compressed HTTP headers that expands in memory into a much larger set. That forces the server to use thousands of times more memory than the attacker sent, which the firm says is enough to run a default server out of memory. The reported amplification reaches up to 4,000-fold.

The practical concern is availability. HTTP/3 is served over QUIC, and a crash triggered by one connection means a single low-cost client can take a service down without credentials or a large bandwidth budget. The source does not name affected implementations, version ranges, patch status or severity scores, so defenders should not assume any particular product is fixed or exposed.

What defenders can do

• Inventory where HTTP/3 is enabled, including at load balancers and CDNs, since it is often turned on by default.
• Ask vendors and upstream projects whether they have addressed QPACK memory amplification and what limits they enforce.
• Watch for restart loops, memory spikes and connection resets on HTTP/3 endpoints, and consider rate limiting or temporarily disabling HTTP/3 where it is not needed.

The source gives no timeline for fixes.