New QPACK Flaws Can Crash HTTP3 Servers Trigger Up to 4000Fold Memory Amplification

A remote attacker who has not logged in can crash many HTTP3 web servers with a single connection security firm FoxIO disclosed releasing working proofofconcept code By sending a small batch of compressed HTTP headers that expands in memory to a much larger set the attacker can force the server to use thousands of times more memory than it received enough to run a default server