A security firm, FoxIO, disclosed new vulnerabilities in HTTP/3 stacks, allowing remote attackers to crash servers with a single connection and up to 4,000-fold memory amplification.
The vulnerability or weakness
The flaw lies in QPACK, the scheme used for compressing HTTP headers in HTTP/3. Affected stacks fail to properly cap the size of headers after unpacking, leading to memory exhaustion.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations using affected HTTP/3 stacks, such as Caddy, Traefik, and LiteSpeed Web Server, could experience server crashes, disrupting operations and potentially leading to financial losses.
Industries affected
The incident affects a wide range of industries, including web hosting, cloud services, and any organization that relies on HTTP/3 for communication.
Users affected
Users of affected servers may experience service disruptions and loss of access to web services. Security teams need to ensure timely updates and patches to mitigate the risk.
