FoxIO discloses HTTP/3 flaws that can crash web servers

Security firm FoxIO has disclosed flaws that can let a remote attacker without an account crash affected HTTP/3 web servers through a single connection. It also released working demonstration code. Fixes are available for several affected software libraries, but others remained unpatched at disclosure, The Hacker News reported on October 22.

HTTP/3 is a protocol used to carry web requests and responses. Servers should limit how much memory they use when unpacking request headers—the fields that carry information about a request. The affected implementations either limit only the compressed information arriving over the network or enforce the unpacked-size limit too late.

The demonstrated impact is denial of service: making a server unable to handle legitimate requests. As of the October 22 report, there was no evidence of data theft or code execution and no public reports of attacks exploiting these flaws.

How small requests consume large amounts of memory

The flaws involve QPACK, HTTP/3's header-compression scheme. QPACK saves space by representing repeated fields with short references rather than sending the full text each time. Without an effective limit during unpacking, a small amount of incoming data can become hundreds of thousands of header entries held in server memory.

In tests using default settings, FoxIO measured memory use of about 4,000 times the incoming data size on Bun. Bun’s documentation labels its HTTP/3 server experimental; the finding is not a report of attacks on production deployments.

Bun uses the lsquic library but replaces its header-memory controls with code that checks each header without checking their combined size. FoxIO found that sufficiently large expanded headers could overflow a size counter, leaving the server in an endless loop that blocked new requests. This separate handling means lsquic’s fix does not resolve Bun’s issue.