Critical QPACK Vulnerabilities Discovered in HTTP/3 Implementations

Security firm FoxIO has revealed a set of critical flaws in the QPACK header compression mechanism integral to HTTP/3, the successor to HTTP/2. According to the disclosure, a remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection.

The attack vector involves sending a small batch of compressed HTTP headers that expand in memory to a much larger set. This exploitation of the QPACK dictionary mechanism forces the server to use thousands of times more memory than it received in the malicious input. The report indicates that this memory amplification can reach up to 4,000 times the size of the incoming data, which is sufficient to exhaust the memory of a default server configuration and cause a denial of service.

FoxIO has released working proof-of-concept code demonstrating the exploit. The vulnerabilities stem from improper handling of header field dictionaries and unbounded memory allocation during the QPACK decompression process. As of the disclosure date, no official patch has been mentioned, and users are advised to monitor vendor advisories for specific updates to affected HTTP/3 server software.