QPACK flaws let a single connection crash many HTTP/3 servers

Security firm FoxIO has disclosed a class of denial-of-service flaws in QPACK, the header-compression scheme used by HTTP/3, that can let a remote, unauthenticated attacker crash many HTTP/3 servers over a single connection, according to The Hacker News. FoxIO found the problem in seven of the ten HTTP/3 implementations it tested and released working proof-of-concept code. Several widely used stacks have shipped fixes, but others remained unpatched as of October 22, 2026.

What happened

According to The Hacker News, an attacker sends a small batch of compressed HTTP headers that expands in server memory into a far larger set, forcing the server to use thousands of times more memory than it received. A server should cap header size after decompression, but the affected stacks either cap only the compressed data on the wire, do not cap the unpacked result, or apply the cap too late. Because HTTP/3 runs over UDP, the request reaches the server before much of the usual filtering applies. FoxIO said its work was inspired by Gal Bar Nahum's earlier MadeYouReset research into HTTP/2.

Technical details

FoxIO measured that in quic-go a 1 MB compressed batch unpacked into about 160,000 header fields and held roughly 15 MB, around 17 times the bytes sent; quic-go's own advisory puts possible expansion around 50 times. A second method stores one header entry of roughly 4 KB and references it thousands of times with one-byte references, producing amplification of about 4,000 times on Bun and 600 to 1,800 times on lsquic, the publication reported.

The worst case was Bun, whose HTTP/3 server uses lsquic but replaces its header memory cap with custom code that checks individual headers but not the running total. Once unpacked headers pass 2 GB, a size counter overflows to zero and the server enters an endless loop. FoxIO reported that a single stream of about 516 KB pins the server at 100% CPU with no recovery. Bun's documentation describes its HTTP/3 server as experimental. The Wireshark issue is separate: it crashes the HTTP/3 dissector when decrypting captured traffic and is not a network-reachable server flaw.

Who is affected

Fixed releases are quic-go 0.57.0 (CVE-2025-64702), Cloudflare quiche 0.29.3 (CVE-2026-12523), lsquic 4.9.0 (no CVE) and Wireshark 4.6.2 / 4.4.12 (CVE-2025-13945). Bun, hyperium's Rust h3 crate and aioquic/mitmproxy were unpatched. The Hacker News noted that quic-go underlies Caddy, Traefik and cloudflared, while lsquic underlies LiteSpeed Web Server and OpenLiteSpeed. IIS, Envoy, ngtcp2/nghttp3 and Google's quiche were reported as not affected. The flaws allow denial of service only, with no evidence of data theft, code execution or attacks in the wild.

What to do

Operators should upgrade to the fixed releases and update products built on quic-go or lsquic, such as Caddy, Traefik, cloudflared and LiteSpeed, once they ship the fixes. FoxIO advised not exposing Bun's HTTP/3 server for now, disabling HTTP/3 in mitmproxy with --set http3=false, and setting a sensible max_field_section_size limit in h3.