A remote, unauthenticated client can force HTTP/3 servers to allocate tens to thousands of times more memory than the request occupies on the wire via QPACK header expansion vulnerabilities. Seven of ten tested implementations were vulnerable, with several already patched. The issue stems from missing or late-enforced decoded-header limits in QPACK implementations.
Background
QPACK is the header compression protocol used in HTTP/3 over QUIC, designed to reduce bandwidth for HTTP header fields. This vulnerability class was initially discovered in HTTP/2 request-cancellation attacks.
- Source
- Lobsters
- Published
- Oct 22, 2026 at 11:15 PM
- Score
- 8.0 / 10