QPACK flaws crash HTTP/3 servers; Bun, h3, aioquic unpatched
FoxIO found QPACK header-decompression flaws in 7 of 10 HTTP/3 stacks. quic-go, quiche and lsquic are patched; Bun, h3 and aioquic are not. A PoC is public; amplification hits 4,000x.
FoxIO found QPACK header-decompression flaws in 7 of 10 HTTP/3 stacks. quic-go, quiche and lsquic are patched; Bun, h3 and aioquic are not. A PoC is public; amplification hits 4,000x.