QPACK flaws can crash HTTP/3 servers via memory amplification
Original title: New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
FoxIO released PoCs; quic-go, quiche, lsquic, and Wireshark are patched, while Bun, h3, and aioquic were not.
FoxIO said an unauthenticated attacker can crash many HTTP/3 servers by sending compressed QPACK headers that expand far beyond the bytes received. The flaws cause denial of service only, with no reported data theft, code execution, or attacks in the wild. Fixes are available for quic-go, Cloudflare quiche, lsquic, and Wireshark. Bun, the h3 Rust library, and aioquic were still unpatched at disclosure on October 22, 2026.
Unconfirmed: Amplification ratios come from FoxIO's tests; Wireshark said it is unaware of exploits for its dissector issue.
- FoxIO found the flaw class in seven of ten stacks tested.
- quic-go 0.57.0 fixes CVE-2025-64702; quiche 0.29.3 fixes CVE-2026-12523.
- lsquic 4.9.0 is fixed and has no CVE assigned.
- Wireshark 4.6.2 and 4.4.12 fix CVE-2025-13945, a dissector crash.
- FoxIO measured about 4,000-fold amplification on Bun.
Impact: Unauthenticated denial of service through memory exhaustion
| Product | Affected | Fixed in |
|---|---|---|
| quic-go | — | 0.57.0 |
| Cloudflare quiche | — | 0.29.3 |
| LiteSpeed lsquic | — | 4.9.0 |
| Wireshark | — | 4.6.2 / 4.4.12 |
| Oven Bun | — | — |
| hyperium h3 | — | — |
| aioquic | — | — |
- 1.Upgrade quic-go to 0.57.0, quiche to 0.29.3, lsquic to 4.9.0, and Wireshark to 4.6.2 or 4.4.12.
- 2.Do not expose Bun's HTTP/3 server until it is patched.
- 3.Disable mitmproxy HTTP/3 with --set http3=false, or set h3 max_field_section_size.
- Vendors
- CloudflareLiteSpeedWireshark
- Organizations
- FoxIO
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-13945 | HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows denial of service | 5.5 | <1% | PoC ×2 | |
| CVE-2025-64702 | quic-go is an implementation of the QUIC protocol in Go | 5.3 | <1% | PoC | |
| CVE-2026-12523 | Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames | 7.5 | <1% |
From the original article
3 min read at thehackernews.com
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code. By sending a small batch of compressed HTTP headers that expands in memory to a much larger set, the attacker can force the server to use thousands of times more memory than it received, enough to run a default server
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.