New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
Summary
Security researchers have discovered critical vulnerabilities in QPACK, a compression protocol used in HTTP/3. A remote attacker can exploit these flaws by sending a crafted batch of compressed HTTP headers, causing significant memory amplification on affected servers. This can lead to server crashes and denial-of-service conditions.
IFF Assessment
The identified vulnerabilities allow remote attackers to crash HTTP/3 servers, representing a direct threat to the availability and stability of web services.
Severity
This vulnerability allows for a remote, unauthenticated attack that can cause a denial-of-service by crashing the server due to excessive memory consumption. The attack complexity is low, and the impact on availability is high, warranting a CVSS score in the High severity range.
Defender Context
Defenders should prioritize patching or updating their HTTP/3 server implementations to address these QPACK vulnerabilities. Monitoring network traffic for anomalous header sizes or patterns can help detect potential exploitation attempts. This highlights the importance of secure protocol implementations in modern web infrastructure.