Skip to content
QPACK Vulnerabilities Allow Denial-of-Service Attacks on HTTP/3 Servers

QPACK Vulnerabilities Allow Denial-of-Service Attacks on HTTP/3 Servers

First seen 22 Oct 2026, 10:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 12:14 UTC
  • •QPACK flaws can cause severe memory exhaustion in HTTP/3 servers.
  • •Seven out of ten tested stacks are vulnerable, with fixes available for some.
  • •No confirmed exploitation has been reported in the wild.

Security firm FoxIO disclosed multiple QPACK flaws affecting HTTP/3 servers, allowing unauthenticated remote attackers to crash servers with a single connection. The vulnerabilities lead to denial-of-service (DoS) attacks by causing excessive memory allocation, with one request potentially expanding to over 4,000 times its original size. Seven out of ten tested HTTP/3 stacks were found vulnerable, including quic-go and Bun, while IIS, Envoy, and Google's quiche were not affected. Fixes were released for several stacks by October 20, 2026, but Bun and aioquic remain unpatched. The vulnerabilities stem from improper handling of decoded header sizes, which can lead to memory exhaustion. No evidence of has been reported as of the disclosure date.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-20
Patches released for several HTTP/3 stacks
Fixes were issued for quic-go, Cloudflare quiche, lsquic, and Wireshark, addressing QPACK vulnerabilities.
The Hacker News
2026-10-22
Vulnerabilities disclosed by FoxIO
FoxIO revealed multiple QPACK vulnerabilities affecting HTTP/3 servers, allowing DoS attacks through excessive memory allocation.
foxio.io

More articles in this cluster (5)

Extracted Entities (14)

1 / 2

Common questions

Which HTTP/3 stacks are vulnerable?
Seven out of ten tested stacks are vulnerable, including quic-go and Bun, while IIS and Envoy are not affected.
What is the nature of the attacks?
The attacks exploit QPACK vulnerabilities to cause denial-of-service by forcing servers to allocate excessive memory.
Have these vulnerabilities been exploited in the wild?
No evidence of active exploitation has been reported as of the disclosure date.