QPACK flaws can crash HTTP/3 servers via memory amplification
FoxIO released PoCs; quic-go, quiche, lsquic, and Wireshark are patched, while Bun, h3, and aioquic were not.
72
VulnerabilityPoC ×2
CVE-2025-13945
- CVSS 3.1
- 5.5 medium
- EPSS
- <1%p13
- Published
- ·
- Modified
Description · NVD
HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows denial of service
In the news
2 storiesQPACK flaws let one HTTP/3 connection exhaust server memory
Seven of ten tested stacks were vulnerable; quic-go, quiche, lsquic and Wireshark had fixes as of October 20, 2026.
68