QPACK Zero-Days: How a Single UDP Packet Can Crash Your HTTP/3 Infrastructure
Executive Summary
In October 2026, security firm FoxIO disclosed critical QPACK header-compression flaws affecting seven of ten HTTP/3 server stacks tested, releasing working proof-of-concept exploit code. An unauthenticated remote attacker can send a small compressed HTTP header batch that expands up to 4,000-fold in server memory, crashing affected servers with a single UDP connection. Impacted stacks include quic-go (CVE-2025-64702), Cloudflare quiche (CVE-2026-12523), lsquic, Bun, the h3 Rust library, and aioquic. Bun carries the worst-case scenario: a 516 KB payload triggers an integer overflow leading to 100% CPU lock with no recovery. Patches exist for quic-go, Cloudflare quiche, lsquic, and Wireshark, but Bun, h3, and aioquic remain unpatched as of disclosure.
This disclosure follows the HTTP/2 "MadeYouReset" denial-of-service research and signals a broader trend of protocol-layer amplification attacks targeting modern cloud-native infrastructure. As HTTP/3 adoption accelerates across CDNs, API gateways, and edge runtimes, unpatched stacks present an immediate availability risk to internet-facing services operating without protocol-aware traffic inspection or egress controls.
Why This Matters Now
HTTP/3 is rapidly becoming the default transport for cloud-native applications, CDNs, and API gateways. Because HTTP/3 runs over UDP, many traditional stateful firewalls and DDoS mitigations do not inspect it effectively. With working proof-of-concept code publicly available and three major stacks still unpatched, operators face an immediate, low-barrier denial-of-service threat requiring urgent patching and protocol-aware network controls.
Attack Path Analysis
An unauthenticated remote attacker exploits QPACK header decompression flaws in vulnerable HTTP/3 stacks by sending a small maliciously crafted compressed header batch over UDP, causing the target server to expand headers into memory at ratios up to 4,000x, exhausting available memory or triggering an integer overflow that locks the server in an infinite CPU loop. Because no authentication, lateral movement, or data exfiltration is required, the attack terminates at Impact with a denial-of-service outcome — crashing or permanently hanging the server process and blocking all legitimate traffic.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
An unauthenticated attacker sends a single crafted HTTP/3 connection over UDP to a publicly exposed server running a vulnerable QPACK implementation (quic-go, lsquic, Bun, h3, aioquic). No credentials, account, or prior access are required. Because HTTP/3 operates over QUIC/UDP, standard TCP-layer filtering and connection-state inspection do not apply before the malicious QPACK-encoded headers are received and processed. CVEs include CVE-2025-64702 (quic-go) and CVE-2026-12523 (Cloudflare quiche).
Related CVEs
CVE-2025-64702
CVSS 5.3A QPACK header decompression vulnerability in quic-go allows a remote unauthenticated attacker to send a small compressed HTTP/3 header batch that expands to a disproportionately large set of header fields in memory, causing denial-of-service through memory exhaustion on affected servers.
Affected Products:
quic-go quic-go – < 0.57.0
Caddyserver Caddy – unspecified versions using quic-go < 0.57.0
Traefik Labs Traefik – unspecified versions using quic-go < 0.57.0
Cloudflare cloudflared – unspecified versions using quic-go < 0.57.0
Exploit Status:
proof of conceptCVE-2026-12523
CVSS 7.5A QPACK header amplification vulnerability in Cloudflare quiche allows a remote unauthenticated attacker to trigger memory exhaustion via crafted compressed HTTP/3 headers, resulting in denial-of-service of the affected server.
Affected Products:
Cloudflare quiche – < 0.29.3
Exploit Status:
proof of conceptCVE-2025-13945
CVSS 5.5A QPACK-related vulnerability in Wireshark's HTTP/3 dissector causes a crash when decrypting HTTP/3 traffic using a key-log file or opening capture files containing decryption secrets, allowing a local or crafted-file-based denial-of-service.
Affected Products:
Wireshark Foundation Wireshark – < 4.6.2, < 4.4.12
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Endpoint Denial of Service
Service Exhaustion Flood
Exploit Public-Facing Application
Exploitation of Remote Services
Command and Scripting Interpreter
Exploitation for Client Execution
Weaken Encryption
Network Denial of Service
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Information Input Validation / Denial of Service Protection
Control ID: SI-10 / SC-5
PCI DSS 4.0 – Vulnerability Management and Security Patching
Control ID: Requirement 6.3.3 / 6.4.1
DORA (EU 2022/2554) – ICT Security and Vulnerability Management / ICT-Related Incident Management
Control ID: Article 9 / Article 10
NIS2 Directive (EU 2022/2555) – Risk Analysis and System Security / Business Continuity and Crisis Management
Control ID: Article 21(2)(a) / Article 21(2)(e)
CISA Zero Trust Maturity Model 2.0 – Micro-Segmentation and Protocol-Level Traffic Inspection
Control ID: Network Pillar — Traffic Filtering / Application Pillar — Application Security Testing
NYDFS 23 NYCRR 500 – Penetration Testing and Vulnerability Management
Control ID: Section 500.5 / Section 500.7
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
HTTP/3 stacks like quic-go, lsquic, and Bun face up to 4,000x memory amplification via QPACK flaws, enabling unauthenticated DoS attacks that crash servers running Caddy, Traefik, and LiteSpeed infrastructure.
Internet
Cloud-delivered web services relying on HTTP/3 over UDP face zero-authentication denial-of-service exposure; unpatched stacks including Bun and aioquic risk 100% CPU lockout with no recovery path.
Computer/Network Security
Multicloud visibility and inline IPS controls are undermined as UDP-based HTTP/3 bypasses conventional filtering; Wireshark dissector crashes further impair forensic traffic analysis and incident response workflows.
Financial Services
PCI DSS 4.0 and NIST.800-53.SC-7 compliance obligations heighten risk exposure for financial platforms using HTTP/3-enabled reverse proxies like Traefik or Cloudflare quiche without confirmed patching to fixed versions.
Sources
- New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplificationhttps://thehackernews.com/2026/10/new-qpack-flaws-can-crash-http3-servers.htmlVerified
- Header Accordions: QPACK Amplification Attacks Against HTTP/3 Servers - FoxIO Research Bloghttps://foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-serversVerified
- Wireshark Security Advisory wnpa-sec-2025-07 - HTTP/3 Dissector Crashhttps://www.wireshark.org/security/wnpa-sec-2025-07.htmlVerified
- quic-go v0.57.0 Release - CVE-2025-64702 Fixhttps://github.com/quic-go/quic-go/releases/tag/v0.57.0Verified
- Cloudflare quiche 0.29.3 Release Noteshttps://github.com/cloudflare/quiche/releases/tag/0.29.3Verified
- lsquic 4.9.0 Release - QPACK Header Cap Fixhttps://github.com/litespeedtech/lsquic/releasesVerified
- NVD Entry CVE-2025-13945https://nvd.nist.gov/vuln/detail/CVE-2025-13945Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant here because the attack exploits unrestricted external reachability to vulnerable HTTP/3 UDP endpoints, and granular segmentation policies could meaningfully reduce which workloads are reachable by unauthenticated public traffic. By constraining the blast radius to only explicitly permitted service surfaces, CNSF would likely limit the scope of servers exposed to malicious QPACK decompression attempts.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Restricting which workloads are allowed to receive inbound QUIC/UDP traffic from untrusted external sources would likely reduce the number of vulnerable HTTP/3 endpoints reachable by an unauthenticated attacker, narrowing the exploitable attack surface before any malformed QPACK payload is processed.
Control: Zero Trust Segmentation
Mitigation: Because no privilege escalation path exists in this attack, Zero Trust Segmentation would not directly constrain escalation activity, but identity-scoped access policies could limit what any compromised workload context is permitted to access, reducing hypothetical downstream scope should the DoS condition be paired with a secondary vulnerability.
Control: East-West Traffic Security
Mitigation: East-west enforcement policies would likely constrain the ability of any downstream effect — such as a crashed service triggering cascading failures — from propagating across segmented workload boundaries, reducing the potential blast radius within a multi-service or multi-tenant environment.
Control: Multicloud Visibility & Control
Mitigation: Centralized multicloud traffic visibility could surface anomalous inbound UDP connection patterns or repeated malformed request signatures across distributed HTTP/3 deployments, potentially reducing the window between first malicious packet and operator awareness, which may allow earlier intervention before full resource exhaustion occurs.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement would likely have no direct bearing on this specific attack's outcome since no data leaves the environment, but controlled egress policies could help confirm the absence of any secondary exfiltration activity, reducing uncertainty about whether the DoS event is being used as a distraction alongside data theft.
If segmentation policies had limited the reachability of vulnerable HTTP/3 workloads to explicitly authorized sources, the population of servers exposed to this denial-of-service condition would likely be smaller, reducing the overall operational impact across distributed deployments and limiting service unavailability to a more constrained set of assets.
Impact at a Glance
Affected Business Functions
- HTTP/3 Web Server Availability and Uptime
- API Gateway and Reverse Proxy Services
- Content Delivery and Edge Network Operations
- Developer Tooling and Traffic Analysis (Wireshark)
Estimated downtime: 1 days
Estimated loss: N/A
No data exfiltration or code execution has been confirmed. The vulnerabilities are limited to denial-of-service impact. Affected organizations running HTTP/3-enabled infrastructure using vulnerable stacks (quic-go, Cloudflare quiche, lsquic, Bun, h3 Rust library, aioquic) face service availability risk. For organizations using Bun's experimental HTTP/3 server, a single crafted stream of approximately 516 KB can cause permanent CPU lockout requiring manual restart, representing a complete loss of availability for that server instance. Financial loss estimates are not publicly quantified but could be significant for high-traffic services dependent on HTTP/3 availability.
Recommended Actions
Key Takeaways & Next Steps
- • Immediately upgrade all HTTP/3 stacks to patched releases (quic-go 0.57.0, Cloudflare quiche 0.29.3, lsquic 4.9.0, Wireshark 4.6.2/4.4.12); for unpatched stacks (Bun, h3, aioquic/mitmproxy), disable HTTP/3 or apply vendor-recommended mitigations such as
--set http3=falseor explicitmax_field_section_sizelimits until fixes are available. - • Deploy Inline IPS (Suricata) signatures targeting anomalous QPACK compressed header patterns and abnormally large QUIC HEADERS frames to detect and block amplification attempts before they reach vulnerable server processes, leveraging CVE identifiers CVE-2025-64702 and CVE-2026-12523 as signature anchors.
- • Enable Multicloud Visibility and Control to baseline normal HTTP/3 UDP traffic volumes per endpoint and alert on sudden spikes in QUIC connection counts, header-frame sizes, or server CPU/memory anomalies consistent with QPACK amplification reconnaissance or active exploitation.
- • Apply Cloud Firewall (ACF) rate-limiting and connection-throttling policies at the network edge for inbound UDP/443 (QUIC) traffic to reduce the blast radius of single-connection amplification attacks, restricting the number of concurrent QUIC streams and maximum header section sizes enforced before application layer processing.
- • Use Zero Trust Segmentation to restrict public exposure of HTTP/3 endpoints to only verified, policy-permitted sources where operationally feasible, and enforce namespace-level policies in Kubernetes environments (AKF) to prevent a crashed HTTP/3 pod from cascading resource exhaustion across co-located workloads sharing node memory.
