New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification

A security firm has disclosed that many HTTP/3 web servers are vulnerable to crashes from a single connection by a remote attacker without login credentials. The attacker can send a small batch of compressed HTTP headers that expand to a much larger set in memory, causing the server to use significantly more memory than it received. This can lead to memory amplification of up to 4,000 times, which is enough to overwhelm a default server. The security firm has released working proof-of-concept code to demonstrate this vulnerability. The issue is related to QPACK flaws, which can be exploited to trigger the memory amplification and server crash.