- FoxIO disclosed a denial-of-service flaw in HTTP/3 servers that allows unauthenticated attackers to crash them with a single connection.
- The vulnerability lies in QPACK header compression, where small compressed headers expand massively in server memory.
- Fixes are available for quic-go, Cloudflare quiche, lsquic, and Wireshark, but Bun, the h3 Rust library, and aioquic remain unpatched.
- Seven of ten tested HTTP/3 stacks were affected, with amplification ratios reaching up to 4,000 times on some implementations.
FoxIO disclosed on October 22, 2026, that unauthenticated attackers can crash many HTTP/3 web servers with a single connection, releasing working proof-of-concept code.
The attack exploits QPACK, HTTP/3’s header compression scheme, by sending small compressed headers that expand into hundreds of thousands of entries in server memory. Consequently, affected stacks cap the compressed data arriving on the wire but fail to limit the unpacked result.
The flaw affects seven of ten HTTP/3 stacks tested, including quic-go (used by Caddy, Traefik, and cloudflared), lsquic (LiteSpeed), and Bun. Meanwhile, IIS, Envoy, and ngtcp2/nghttp3 were not affected because they cap unpacked headers during decoding.
Amplification varies by stack. On quic-go, a 1 MB compressed batch unpacks into 160,000 header fields, consuming roughly 15 MB—about 17 times expansion.
A second technique stores one 4 KB header entry and references it thousands of times, achieving 4,000-times amplification on Bun. On Bun, once unpacked headers exceed 2 GB, a size counter overflows to zero, leaving the server stuck at 100 percent CPU with a single 516 KB stream.
Fixed versions include quic-go 0.57.0, Cloudflare quiche 0.29.3, lsquic 4.9.0, and Wireshark 4.6.2/4.4.12. However, Bun, the h3 Rust library, and aioquic remain unpatched.
FoxIO recommends operators avoid exposing Bun HTTP/3 servers, disable HTTP/3 on mitmproxy with –set http3=false, and set max_field_section_size for the h3 Rust library. The research began after Gal Bar Nahum’s “MadeYouReset” work on HTTP/2 denial-of-service techniques.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
