A QPACK implementation flaw can turn a tiny HTTP/3 request into a serious memory exhaustion problem.
FoxIO’s Header Accordion research reports up to 4,064× memory amplification in Bun.
The key issue: compressed headers on the wire can expand into massive allocations during QPACK decompression.
A deep dive into the attack, affected implementations, CVEs, and mitigations:
https://thecybersecguru.com/exploits/qpack-header-accordion-http3-dos/
Content warning: QPACK Header Accordion attacks exploit HTTP/3 header compression to trigger memory exhaustion. Learn the affected libraries, CVEs, and mitigation steps
The CyberSec GuruQPACK Header Accordion Attack: HTTP/3 DoS Explained | The CyberSec GuruQPACK Header Accordion attacks exploit HTTP/3 header compression to trigger memory exhaustion. Learn the affected libraries, CVEs, and mitigation steps