Qpack amplification attacks against HTTP/3 servers
Researchers have identified a vulnerability in HTTP/3 servers where QPACK header compression can be exploited to force excessive memory allocation. This amplification attack allows a single unauthenticated client to crash servers by sending small requests that expand into massive memory loads.
Why it matters
This represents a significant denial-of-service risk for modern web infrastructure, as many major HTTP/3 implementations were found to be vulnerable to resource exhaustion.
')"> Header Accordions: QPACK amplification attacks against HTTP/3 servers
A remote, unauthenticated client can force an HTTP/3 server to allocate tens to thousands of times more memory than it sends. One connection is enough to OOM or pin a default-configured server. Seven of the ten implementations tested are vulnerable; several are already fixed.
QPACK compresses HTTP/3 headers to minimize traffic sent over the wire. Across the affected implementations, decoded-header limits are missing, incomplete, or applied too late. A small HEADERS frame can therefore expand into hundreds of thousands of header objects in memory. Preventing that expansion from exhausting resources requires enforcing a cumulative budget as fields are decoded and retained.
mitmproxy: disable HTTP/3 (pass --set http3=false )
h3 crate: set a reasonable max_field_section_size
Not affected : IIS, Envoy, ngtcp2/nghttp3
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in