QPACK flaws can crash HTTP/3 servers via memory amplification
FoxIO released PoCs; quic-go, quiche, lsquic, and Wireshark are patched, while Bun, h3, and aioquic were not.
Stories per day · 30 days
2 stories, newest first · one card per story
Stories tagged #qpack
CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification
Researchers disclosed two DoS attacks exploiting CDNs' HTTP/3-to-HTTP/1.1 translation to amplify low-bandwidth requests up to 350x against origin servers.
1