QPACK Vulnerabilities Enable HTTP/3 Server Crashes and Memory Amplification Attacks
Multiple flaws in the QPACK compression format used by HTTP/3 can allow remote attackers to crash servers through memory amplification attacks, consuming thousands of times more memory than the initial request.
Security researchers at FoxIO have identified a class of vulnerabilities within the QPACK compression format, a critical component of the HTTP/3 protocol, that can lead to denial-of-service (DoS) conditions on affected web servers. By crafting and sending specially malformed compressed HTTP headers, attackers can trigger a significant memory amplification effect, forcing servers to consume exponentially more memory than the initial request size.
The core of the issue lies in how various HTTP/3 implementations handle the decompression and subsequent memory allocation for headers. While QPACK is designed to reduce bandwidth by compressing repetitive header fields into short codes, the affected server stacks fail to adequately cap the size of these headers *after* decompression. This allows a relatively small compressed header batch to expand into a massive number of header entries in memory, overwhelming the server's resources.
FoxIO's analysis revealed that seven out of ten tested HTTP/3 stacks were susceptible to this vulnerability. The impact is primarily denial-of-service, with no evidence suggesting data theft or remote code execution. While no attacks in the wild have been publicly reported, the potential for widespread disruption is significant given the ubiquity of these affected stacks.
Several popular libraries and servers have released patches for these flaws. These include quic-go (versions 0.57.0 and later), Cloudflare's quiche (0.29.3 and later), lsquic (4.9.0 and later), and Wireshark (4.6.2 / 4.4.12). However, at the time of disclosure, Bun, the h3 Rust library (hyperium), and aioquic (used in tools like mitmproxy) remained unpatched.
The memory amplification can manifest in two ways. A straightforward expansion can increase memory usage by tens of times the original request. However, a more severe amplification technique involves an attacker repeatedly referencing a single, small header entry thousands of times. This forces the server to reconstruct the full header entry on each reference, leading to amplification ratios as high as 4,000x in some cases, as observed with Bun.
Bun's HTTP/3 server, described as experimental, is particularly vulnerable. It replaces parts of the lsquic library's memory capping mechanism with its own code, which fails to track the total memory usage. This allows an attacker to reach a state where the server's memory usage exceeds 2 GB, causing a counter to overflow and the server to enter an unrecoverable loop, consuming 100% CPU and blocking all new requests.
Wireshark, a network protocol analyzer, is affected differently. The vulnerability here targets the HTTP/3 dissector, which can crash when Wireshark decrypts traffic using a key-log file or opens a capture file containing decryption secrets. This is not a network-accessible server vulnerability but rather an issue within the analysis tool itself.
To mitigate these risks, operators are urged to update to the patched versions of the affected software. For unpatched stacks, interim measures include disabling HTTP/3 on Bun, setting http3=false for mitmproxy, or configuring max_field_section_size for the h3 Rust library. The research was inspired by previous work on similar denial-of-service techniques against HTTP/2, prompting an investigation into potential weaknesses in HTTP/3's header compression.