As cited
Copy frozen at (site build).
vulnerabilities
New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
FoxIO disclosed flaws in QPACK, the HTTP/3 header compression standard, that allow unauthenticated attackers to crash servers by sending specially crafted compressed headers that expand to consume thousands of times more memory than the original payload. The vulnerability enables a 4,000-fold memory amplification attack with a single connection, and working proof-of-concept code has been released.
Why it matters: HTTP/3 server operators face an immediate denial of service risk from low-cost, unauthenticated attacks that can exhaust memory on default configurations; patch availability and mitigation guidance are critical to evaluate today.
- Source published
- First seen by Cybersecurity Tracker