# QPACK Flaws Expose HTTP/3 Servers to Memory Amplification Attacks

*Published October 23, 2026*
*Source: [https://thehackernews.com/2026/10/new-qpack-flaws-can-crash-http3-servers.html](https://thehackernews.com/2026/10/new-qpack-flaws-can-crash-http3-servers.html)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/qpack-flaws-expose-http-3-servers-to-memory-amplification-attacks) or [see plans](https://www.sec-news.ai/pricing).*

## Article

Security firm FoxIO has revealed vulnerabilities in QPACK, the compression scheme used by HTTP/3, which allow remote unauthenticated attackers to crash web servers through massive memory amplification. By sending a small number of compressed HTTP headers that expand significantly in memory, attackers can force servers to consume exponentially more memory than anticipated, potentially leading to denial-of-service attacks. Although no data theft or code execution has been reported, these vulnerabilities are concerning due to their widespread impact.

FoxIO found that seven out of ten tested HTTP/3 stacks were affected by this class of flaw. The problem arises when servers fail to properly cap the size of unpacked headers, leading to excessive memory usage. Some implementations apply the cap too late, allowing a single request to expand into numerous header entries that consume server resources. This issue is particularly severe in stacks like Bun, where a lack of proper memory capping can cause the server to enter an unrecoverable loop.

Various HTTP/3 stacks have already released fixes. For instance, updates are available for quic-go, Cloudflare quiche, lsquic, and Wireshark. However, vulnerabilities remain in Bun, the h3 Rust library, and aioquic. Operators using these stacks should implement interim measures, such as disabling HTTP/3 or setting appropriate limits, while awaiting patches. Users of lsquic are advised to update to the latest fix that caps the number of unpacked header sets per stream.

The broad reach of affected stacks, including those underlying popular software like Caddy, Traefik, and LiteSpeed Web Server, underscores the urgency of addressing these vulnerabilities. Organizations should prioritize updating their systems to the latest versions and follow recommended mitigation strategies to protect against potential attacks.