HTTP/3 Servers Can Be Crashed by a Single Request, Researchers Warn

Security firm FoxIO has disclosed a class of flaws in HTTP/3 software that lets a remote attacker with no login crash a server using a single connection. The attacker sends a small batch of compressed request headers that expands in memory to something far larger. In FoxIO's tests this was enough to run a default server out of memory. FoxIO also released working proof-of-concept code. The flaws cause denial of service only; there is no evidence of data theft or code execution, and no public reports of attacks in the wild.

The problem sits in QPACK, the scheme HTTP/3 uses to compress headers. Affected stacks limit the compressed data arriving on the wire, but not the unpacked result, or apply the limit too late. FoxIO found the issue in seven of ten stacks tested. Amplification varied: about 17 times on quic-go in one test, and roughly 4,000 times on Bun and 600 to 1,800 times on lsquic using a second method. The reach is wide because these libraries sit under common software, including Caddy, Traefik, cloudflared, LiteSpeed Web Server and OpenLiteSpeed. Because HTTP/3 runs over UDP, requests arrive before much usual filtering applies.

Fixes are available for quic-go, Cloudflare quiche, lsquic and Wireshark. Bun, the h3 Rust library and aioquic were still unpatched at disclosure. FoxIO lists IIS, Envoy, ngtcp2/nghttp3 and Google's quiche as not affected. This summary draws on the opening of the article only.