The attack works by sending a small batch of compressed HTTP headers that expands in memory to a much larger set. This forces the server to consume thousands of times more memory than the data it received — with amplification reaching up to 4,000-fold — which is enough to exhaust resources on a default server configuration and take it down.

Key points:

• QPACK header compression in HTTP/3 is affected.
• No authentication is required; a single connection is sufficient to trigger the crash.
• The technique relies on memory amplification from compressed headers expanding far beyond their on-wire size.
• Working proof-of-concept code has been published by FoxIO.

The disclosure did not include specific CVE identifiers in the available reporting, so affected organizations should track advisories from their HTTP/3 server vendors for patches and mitigations.

Source: The Hacker News

Is your organization running HTTP/3 in production, and have you applied vendor mitigations yet?