New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification

Security firm FoxIO has published proof-of-concept exploits for a class of QPACK header-decompression bugs affecting multiple HTTP/3 implementations, including quic-go, Cloudflare's quiche, lsquic, Wireshark and Bun. By sending a small batch of compressed headers, an unauthenticated attacker can force a server to expand them into far larger data in memory — in some cases up to 4,000 times the original size — exhausting server RAM with a single connection and causing a denial of service.

The root cause is that affected stacks limit the size of headers as received on the wire but fail to properly cap the size after decompression, or apply the limit too late. This affects software built on these libraries, such as Caddy, Traefik, cloudflared, LiteSpeed Web Server and OpenLiteSpeed. Fixes are already available: quic-go 0.57.0 (CVE-2025-64702), quiche 0.29.3 (CVE-2026-12523), lsquic 4.9.0, and Wireshark 4.6.2/4.4.12 (CVE-2025-13945). Bun, the h3 Rust library and aioquic remain unpatched, with Bun facing the worst case — a counter overflow that can pin the server at 100% CPU indefinitely. No exploitation in the wild has been reported, and FoxIO recommends operators update immediately or apply the interim mitigations described for still-vulnerable stacks.