QPACK Flaws Let Attackers Crash HTTP/3 Servers
FoxIO disclosed QPACK header decompression bugs in multiple HTTP/3 stacks. Attackers can trigger up to 4,000x memory amplification from a single connection. Patches are available for quic-go, Cloudflare quiche, and lsquic.
Dave "Kilobaud" FerrisSecurity firm FoxIO published research this week showing that several HTTP/3 server implementations share a common misunderstanding about how to validate QPACK header decompression output. The result: a single unauthenticated connection can consume enough server memory to cause a crash or an unrecoverable CPU spike, depending on the stack.
The underlying mechanic is straightforward. QPACK, HTTP/3’s header compression scheme, allows references to previously stored header entries. Affected implementations cap the compressed input arriving on the wire but do not check the size of what gets rebuilt from it. An attacker stores roughly a 4 KB entry once, then references it thousands of times using one-byte pointers. The server faithfully reconstructs the full entry on every reference.
FoxIO measured approximately 4,000x amplification on Bun and 600 to 1,800x on lsquic. On Bun specifically, about 516 KB sent on the wire triggers 100 percent CPU utilization with no recovery path, caused by an integer overflow that kicks in when unpacked headers exceed 2 GB.
Affected implementations
The following stacks have patches available:
| Implementation | CVE | CVSS | Fixed version |
|---|---|---|---|
| Cloudflare quiche | CVE-2026-12523 | 7.5 (High) | quiche 0.29.3 |
| quic-go | CVE-2025-64702 | 5.3 (Medium) | quic-go 0.57.0 |
| Wireshark | CVE-2025-13945 | 5.5 (Medium) | 4.6.2 / 4.4.12 |
| lsquic | n/a | n/a | lsquic 4.9.0 |
Bun’s HTTP/3 server, the h3 Rust library, and aioquic (which also affects mitmproxy) do not have patches as of October 22.
IIS, Envoy, ngtcp2/nghttp3, and Google quiche are not affected.
What this looks like in practice
No exploitation in the wild has been reported. FoxIO released proof-of-concept code alongside the disclosure, so the mechanics are now public.
The severity gap between the scores and the actual impact is worth noting. A CVSS 7.5 on quiche understates what a sustained stream of these requests looks like operationally: quiche processes are not hanging gracefully, they are consuming memory until the process dies.
Mitigation
For patched stacks: update to the fixed versions listed above.
For unpatched stacks: disable HTTP/3 entirely on mitmproxy, avoid exposing Bun’s experimental HTTP/3 server to untrusted input, and set max_field_section_size to a sane limit on h3. These are workarounds, not fixes.
The vulnerability class itself is not new. Decompression bombs have shown up in gzip and zlib handling for years. HTTP/3 being newer does not make it exempt from that category of mistakes, and this research suggests the QPACK spec does not make the limit requirement obvious enough for independent implementers to get it right consistently.
Source: FoxIO QPACK research via The Hacker News
Related coverage
- [ HIGH ]CVE-2026-12523QPACK header decompression amplification in Cloudflare quiche
Found this useful? Share it.
