Executive Summary
A significant class of vulnerabilities has been discovered in several HTTP/3 implementations, rooted in the QPACK header compression scheme. Dubbed 'QPACK Amplification Attacks,' these flaws allow unauthenticated remote attackers to crash web servers by sending small, compressed HTTP headers that expand up to 4,000 times their original size in the server's memory. This memory exhaustion or CPU spikes can lead to a total denial-of-service (DoS) for affected services.
The vulnerability arises because affected stacks, such as quic-go, lsquic, and Bun, fail to properly cap the size of headers after they are unpacked, or apply limits only after the memory has already been consumed. While fixes are available for major libraries like quic-go (used by Caddy and Traefik) and Cloudflare's quiche, several other stacks including Bun and aioquic remained unpatched at the time of disclosure.
While there is no evidence of data theft or remote code execution, the impact on availability is severe. Because HTTP/3 utilizes UDP, these malicious requests can often bypass traditional network filters that are optimized for TCP, making the attack relatively easy to execute without special access or account credentials.
Key Details
Threat Name
QPACK Amplification Attack
Affects
quic-go, Cloudflare quiche, Wireshark
Adversary
—
MITRE Techniques
—
Malware/Tools
None identified