SecurityThe Hacker Newsabout 4 hours ago
QPACK Flaws Crash HTTP/3 Servers
4 min read
Security firm FoxIO disclosed remote flaws in QPACK that can crash HTTP/3 servers and trigger up to 4,000-fold memory amplification. While fixes exist for quic-go and lsquic, the Bun and h3 libraries remain unpatched as of October 22, 2026, leaving some stacks exposed to denial-of-service attacks without data theft.
Level
Hype check
Tap to vote and see what everyone thinks.