Header Accordions: QPACK amplification attacks against HTTP/3 servers - FoxIO | Cyber Innovation
- TLDRA remote, unauthenticated client can force an HTTP/3 server to allocate tens to thousands of times more memory than it sends.
- One connection is enough to OOM or pin a default-configured server.
- Seven of the ten implementations tested are vulnerable; several are already fixed.
Unverified
- TLDRA remote, unauthenticated client can force an HTTP/3 server to allocate tens to thousands of times more memory than it sends.
- One connection is enough to OOM or pin a default-configured server.
- Seven of the ten implementations tested are vulnerable; several are already fixed.
Sources: Foxio