vulnerability
New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
Medium
Summary
A vulnerability in HTTP/3 stacks, identified by FoxIO, allows a remote attacker to crash web servers by sending a small batch of compressed HTTP headers that expands dramatically in memory, potentially leading to a denial-of-service attack. The issue stems from a flaw in QPACK, the HTTP/3 header compression scheme, and is related to a denial-of-service technique targeting HTTP/2.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data