New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
-
Researchers at FoxIO have disclosed vulnerabilities in QPACK, the header compression mechanism used by HTTP/3, and released working proof-of-concept code. According to the firm, a remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection.
The attack works by sending a small batch of compressed HTTP headers that expands in memory to a much larger set. This forces the server to consume thousands of times more memory than the data it received — with amplification reaching up to 4,000-fold — which is enough to exhaust resources on a default server configuration and take it down.
Key points:
- QPACK header compression in HTTP/3 is affected.
- No authentication is required; a single connection is sufficient to trigger the crash.
- The technique relies on memory amplification from compressed headers expanding far beyond their on-wire size.
- Working proof-of-concept code has been published by FoxIO.
The disclosure did not include specific CVE identifiers in the available reporting, so affected organizations should track advisories from their HTTP/3 server vendors for patches and mitigations.
Source: The Hacker News
Is your organization running HTTP/3 in production, and have you applied vendor mitigations yet?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login