New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
- ID
- 38243
- Status
- summarized
- Published
- 22 Oct 2026, 2:38 PM
- Fetched
- 22 Oct 2026, 5:48 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/10/new-qpack-flaws-can-crash-http3-servers.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 4.0
- Created
- 22 Oct 2026, 5:48 PM
- Tags
- Audience
- developers
What happened
The Hacker News reports newly disclosed QPACK flaws that can crash HTTP/3 servers and trigger memory amplification of up to 4,000-fold. The supplied excerpt is truncated after the headline and site boilerplate: it contains no CVE identifiers, no named affected server implementations or versions, no patch guidance, and no researcher attribution. Beyond the headline claim, nothing in this text can be verified or acted on.
Why it matters
There is no decision you can make from this excerpt: with no affected-implementation list or fixed-version numbers, you cannot check whether your own nginx/Caddy/Envoy/QUIC stack is exposed. The one concrete judgement call is architectural — if you terminate HTTP/3 yourself, you are waiting on an advisory with CVE IDs before you can patch, whereas if a CDN or managed edge handles QUIC for you, this is probably their patch to apply and not yours.
Discussion angle
Ask the room who actually terminates HTTP/3 on their own infrastructure versus behind a CDN — that split determines whether a 4,000x memory amplification bug is your on-call problem or your vendor's, and it's a gap most teams have never explicitly mapped.