QPACK flaws let a single HTTP/3 request balloon server memory
FoxIO tested ten HTTP/3 implementations and found seven vulnerable to a header-compression bug, with Bun showing the worst blow-up at roughly 4,000 times the request size.
FoxIO published a class of amplification attacks on 21 October against QPACK, the header-compression format HTTP/3 uses. Across ten tested implementations, seven let a remote, unauthenticated client send one small HEADERS frame and have the server unpack it into far more memory than it took on the wire.
quic-go, Cloudflare’s quiche and Wireshark already have fixed releases with CVEs assigned; lsquic is fixed too, without one. Bun, the Rust h3 library and aioquic/mitmproxy remain unpatched as of publication. Bun comes off worst, holding onto roughly 4,000 times the bytes an attacker sent. IIS, Envoy and ngtcp2/nghttp3 were not affected.
Why it matters: this is denial of service, not data theft or code execution, but it needs only one request and no authentication. If you run an HTTP/3-facing server on Bun, or terminate QUIC through one of the other named libraries, check which version you’re on and watch for a Bun fix, since 1.4.3 is still exposed.
The caveat: FoxIO found no evidence of in-the-wild exploitation, so this is one to patch on your normal cycle once fixes land, not an emergency.