Act
active
QPACK Flaws Allow Unauthenticated DoS and 4,000x Memory Amplification on HTTP/3 Servers
- Engineer — Act: A public PoC now exists for crashing HTTP/3 servers with a single unauthenticated request via QPACK header expansion; audit whether HTTP/3 is enabled on your edge servers (nginx, Caddy, Envoy, etc.) and disable it or apply vendor patches as they arrive — exposure is immediate with PoC code released.
- SOC/IR — Plan: No active exploitation campaign is reported, but the public PoC lowers the bar quickly; build detections for anomalous single-connection HTTP/3 sessions paired with server OOM events or abrupt restarts, and add HTTP/3 header-decompression anomalies to your edge-device monitoring coverage.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.