QPACK defects put HTTP/3 servers at denial-of-service risk

Security firm FoxIO has disclosed QPACK flaws that can let an unauthenticated remote attacker crash many HTTP/3 servers through a single connection. The issues affect seven of the 10 HTTP/3 stacks FoxIO tested and can turn a small compressed header batch into a far larger in-memory structure, with measured amplification reaching roughly 4,000 times on Bun.

The defects are denial-of-service issues. FoxIO reported no evidence of data theft or code execution, and no public reports of exploitation in the wild. Patches were available at disclosure for quic-go, Cloudflare quiche, lsquic and Wireshark, while Bun, the h3 Rust library and aioquic remained unpatched.

Compressed input, unbounded decoded headers

HTTP/3 uses QPACK to compress repeated request-header fields. Rather than sending the same full text repeatedly, a client can transmit short references. A server should enforce a limit on the size of the header section after decoding it, but affected implementations either limited only the compressed data received on the wire or applied the check too late.

That gap can cause a server to allocate and retain hundreds of thousands of decoded header entries from a much smaller incoming batch. The attack requires no account or special access. Because HTTP/3 operates over UDP, the request can reach the server before much of the filtering commonly applied to connection-oriented traffic.

Impact varies by implementation

In FoxIO's default-setting tests, a 1 MB compressed batch against quic-go expanded to about 160,000 header fields and roughly 15 MB retained in a request, or about 17 times the transmitted size. quic-go's advisory estimated potential expansion at around 50 times.

A separate approach produces much greater amplification: an attacker stores one header entry of roughly 4 KB and then references it thousands of times using one-byte pointers. FoxIO measured around 4,000-fold amplification on Bun and between 600 and 1,800 times on lsquic.

Bun has a particularly severe failure mode. Its experimental HTTP/3 server uses lsquic but replaces the component that limits total header memory. FoxIO found that the replacement checks individual headers without tracking a running total. Once decoded headers exceed 2 GB, a size counter can overflow to zero, leaving the server in an unrecoverable loop. A stream of about 516 KB on the wire was reported to hold Bun at 100 percent CPU and block new requests.

Patch status and mitigation choices

Operators can upgrade quic-go to 0.57.0 for CVE-2025-64702, Cloudflare quiche to 0.29.3 for CVE-2026-12523, lsquic to 4.9.0, and Wireshark to 4.6.2 or 4.4.12 for CVE-2025-13945. The lsquic update, released on July 16, 2026, limits the number of decoded header sets retained per stream to one by default.

Wireshark's flaw is distinct from the server issues: it can crash the HTTP/3 dissector when encrypted traffic is opened with a key-log file or a capture containing decryption secrets. Wireshark said it was unaware of exploits, and this issue is not a network-reachable server attack.

For unpatched software, FoxIO advises not exposing Bun's HTTP/3 server, disabling HTTP/3 in mitmproxy with --set http3=false, and configuring a sensible max_field_section_size for h3. IIS, Envoy, ngtcp2/nghttp3 and Google's quiche were not affected because they cap decoded headers during processing. The practical business implication is to inventory the HTTP/3 stack beneath public services, apply the available upgrades, and restrict HTTP/3 exposure where decoded-header limits cannot yet be assured.