## New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification

- 種別: news
- 公開日時: 2026-10-22T06:38:31.000Z
- 情報源: The Hacker News (https://thehackernews.com/2026/10/new-qpack-flaws-can-crash-http3-servers.html)
- パーマリンク: https://vulnpulse.app/items/thehackernews-059d0a92d893

A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code. By sending a small batch of compressed HTTP headers that expands in memory to a much larger set, the attacker can force the server to use thousands of times more memory than it received, enough to run a default server