QPACK Flaw Lets Attackers Exhaust Memory in Major HTTP/3 Libraries
Researchers identified a QPACK amplification vulnerability in HTTP/3, allowing unauthenticated clients to force servers to allocate up to thousands times more memory than sent. Seven of ten tested implementations, including quic-go and Cloudflare's quiche, are vulnerable. Fixes are available for several libraries, while others like Bun and h3 remain unpatched. The flaw highlights resource management risks in modern web protocols.
Key points
- Researchers at foxio.io discovered a QPACK amplification attack affecting HTTP/3 servers, where a single connection can exhaust memory via decoded header expansion.
- Seven of ten tested QUIC/HTTP/3 implementations are vulnerable, including quic-go, Cloudflare's quiche, lsquic, and Wireshark, while IIS, Envoy, and ngtcp2 are unaffected.
- Patches released by October 20, 2026, include quic-go version 0.57.0 (CVE-2025-64702) and Cloudflare quiche version 0.29.3 (CVE-2026-12523).
- Unpatched libraries as of October 20, 2026, include Bun 1.4.3, the h3 crate, and aioquic, requiring manual mitigations like disabling HTTP/3 or setting size limits.
- The vulnerability stems from missing or late-applied decoded-header limits, allowing small HEADERS frames to expand into hundreds of thousands of memory objects.
- The issue was found during research for the JA4Scan active TLS scanner, impacting global web infrastructure relying on QUIC-based HTTP/3.
Security researchers have identified a significant vulnerability in HTTP/3 implementations, allowing remote, unauthenticated clients to trigger memory exhaustion through QPACK header compression. The flaw, discovered during development of the JA4Scan TLS scanner, enables a single connection to force a server to allocate tens to thousands of times more memory than the incoming data occupies. This amplification effect can cause out-of-memory errors or pin resources on default-configured servers.
The investigation found that seven of ten tested QUIC and HTTP/3 libraries are susceptible to this attack. Vulnerable implementations include quic-go, Cloudflare's quiche, lsquic, and Wireshark. The root cause lies in incomplete or missing limits on decoded headers, allowing small HEADERS frames to expand into massive memory objects. In contrast, IIS, Envoy, and ngtcp2/nghttp3 were found to be unaffected.
As of October 20, 2026, several libraries have released patches. quic-go fixed the issue in version 0.57.0 (CVE-2025-64702), while Cloudflare's quiche addressed it in version 0.29.3 (CVE-2026-12523). Wireshark released fixes in versions 4.6.2 and 4.4.12 (CVE-2025-13945). However, Bun 1.4.3, the h3 crate, and aioquic remain unpatched, requiring developers to apply manual mitigations such as disabling HTTP/3 or enforcing strict field section size limits. This widespread impact underscores the need for robust resource management in modern web protocols.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
