QPACK flaws crash HTTP/3 servers; Bun, h3, aioquic unpatched

Security firm FoxIO disclosed a class of QPACK header-decompression flaws affecting seven of ten HTTP/3 stacks it tested, and released working proof-of-concept code. A remote, unauthenticated attacker can send a small batch of compressed headers that expands in memory to thousands of times its wire size, exhausting server memory or pinning CPU — enough to take down a default server with a single connection. FoxIO's writeup is the primary source; The Hacker News has the cross-stack summary.

Affected stacks and fixes

FoxIO lists IIS, Envoy, ngtcp2/nghttp3 and Google's quiche as not affected, because they cap the volume of unpacked headers during decoding. The Wireshark issue is a different animal: it crashes the HTTP/3 dissector when opening a capture with decryption secrets, not a network-reachable server.

The amplification

Two measurement methods, two ranges:

• Expansion of a single compressed batch: on quic-go at default settings, a 1 MB batch held ~15 MB in memory (~17x); quic-go's own advisory estimates up to ~50x.
• Repeated references into the dynamic table: ~4,000x on Bun, and 600x–1,800x on lsquic. The headline figure comes from the Bun case.

Bun's worst case is the sharpest: its HTTP/3 server uses lsquic but adds a header-memory check that doesn't track the running total. Once unpacked headers exceed 2 GB, a size counter overflows to zero and the server loops indefinitely — a single stream of about 516 KB on the wire pinned the server at 100% CPU with no recovery.

Exploitation status

No public reports of in-the-wild attacks, and no evidence of data theft or code execution — this is a denial-of-service class. But FoxIO's PoC is public, so the barrier to opportunistic abuse is low.

Action checklist

1. quic-go → 0.57.0, Cloudflare quiche → 0.29.3, lsquic → 4.9.0. Check transitive pins; these ship inside larger products.
2. Running Bun, hyperium h3, or aioquic/mitmproxy as an HTTP/3 server? No fix exists yet. Disable HTTP/3 / QUIC listeners on exposed instances, or front them with a terminator that caps decompressed headers (IIS, Envoy, nghttp3, Google quiche).
3. Wireshark → 4.6.2 or 4.4.12 if you open HTTP/3 captures with decryption keys — a malicious capture crashes the dissector.
4. Audit which of your edge and service-mesh components speak HTTP/3 at all; many enable it by default.

Context

QPACK is HTTP/3's answer to HPACK, and this is the same decompression-amplification shape that hit HTTP/2's HPACK years ago — a dynamic table that lets one small message reference a lot of state. FoxIO finding the flaw in seven of ten implementations says the lesson didn't travel across the protocol rewrite: the stacks that are safe are the ones that cap unpacked headers, and that cap should have been table stakes.