New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
New flaws in QPACK, the header compression format used by HTTP/3, can crash HTTP/3 servers and trigger up to 4,000-fold memory amplification, The Hacker News reports. https://thehackernews.com/2026/10/new-qpack-flaws-can-crash-http3-servers.html
The Hacker NewsNew QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory AmplificationFoxIO disclosed QPACK flaws in seven HTTP/3 stacks that can cause denial of service through header expansion, with three stacks still unpatched.