CuraSec

tag: Http3 · 3 items

Act QPACK Flaws Allow Unauthenticated DoS and 4,000x Memory Amplification on HTTP/3 Servers
2026-10-22 · The Hacker News · source ↗ #http3#denial-of-service#memory-amplification
  • Engineer — Act: A public PoC now exists for crashing HTTP/3 servers with a single unauthenticated request via QPACK header expansion; audit whether HTTP/3 is enabled on your edge servers (nginx, Caddy, Envoy, etc.) and disable it or apply vendor patches as they arrive — exposure is immediate with PoC code released.
  • SOC/IR — Plan: No active exploitation campaign is reported, but the public PoC lowers the bar quickly; build detections for anomalous single-connection HTTP/3 sessions paired with server OOM events or abrupt restarts, and add HTTP/3 header-decompression anomalies to your edge-device monitoring coverage.
  • Leader — Skip
Plan archived CDN Tsunami: HTTP/3-to-1.1 Translation Enables 350x DoS Amplification
2026-08-22 · The Hacker News · source ↗ #cdn#dos-amplification#http3
  • Engineer — Plan: If your origin sits behind a CDN that terminates HTTP/3, verify your CDN vendor has addressed this class of amplification and ensure your origin enforces its own rate limits independent of CDN-layer protections — CDN Tsunami demonstrates that relying solely on CDN-side controls can leave the origin exposed to amplified floods.
  • SOC/IR — Learn: No active exploitation or IOCs reported; the attack surface is origin-server availability rather than a detectable intrusion behavior, so there is no detection rule or hunt to build today — file as background on CDN-based availability risk.
  • Leader — Learn: Novel research with no reported exploitation means no immediate risk-register update is warranted, but CISOs who depend on CDN availability SLAs for customer-facing services should note this as context for future CDN vendor security reviews.
Plan archived Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers
2026-07-11 · The Hacker News · source ↗ #http3#denial-of-service#quic
  • Engineer — Plan: XQUIC is Alibaba’s QUIC/HTTP/3 library — audit whether it’s in your stack (Alibaba Cloud, CDN edge, or any Go/C++ HTTP/3 service built on it); no patch exists yet, so consider disabling HTTP/3 endpoints or adding rate-limiting on QPACK traffic as interim mitigation. No KEV or EPSS signal, but a zero-auth 260-byte crash with no malformed packets is trivially weaponizable.
  • SOC/IR — Learn: No active exploitation or IOCs reported; the attack surface is interesting for future detection rule design around anomalous HTTP/3 QPACK request volumes causing server restarts, but there is nothing to hunt today.
  • Leader — Skip