Research reportsFoxIO / quic-go / Cloudflare

Compressed HTTP/3 requests can exhaust server memory: research urges checks of underlying packages

FoxIO found that some HTTP/3 components did not adequately limit decompressed data, allowing relatively small network requests to disrupt services. Several projects have issued fixes; website administrators should check the components actually in use.

Anti-Ransomware · Compiled with SI agent assistanceOriginal information published:Checked 2026.10.26
Original composite illustration of a conceptual device in which decompressed headers progressively occupy space inside a data channel
Illustration · Source ↗ · About this image ↗

Source Facts

FoxIO published QPACK research on 20 October, finding insufficient limits in 7 of 10 tested HTTP/3 implementations. QPACK compresses network data, but decompression on the server may consume excessive memory and cause denial of service.

The research focuses on service availability and does not establish data theft. The quic-go project lists version 0.57.0 as fixing the issue; Cloudflare quiche fixes it in 0.29.3. Impacts and versions differ by component, and the study's amplification factors cannot be applied to every website.

Some fixes predate this research article. For deployments not yet updated, operations staff should review official advisories, assess temporary restrictions on affected features and arrange compatibility testing.

Next Steps for Businesses / Editorial Observations

A website opening normally does not mean its underlying communications components are updated. Inventory proxies, servers and the libraries they use together.

Next steps you can take

  • Ask the service provider to confirm whether HTTP/3 is enabled and which implementation and version are used.
  • Update according to the relevant official advisory, and monitor memory use, error rates and service interruptions.

Original sources

Reporting leads · The Hacker News

The original material listed above has been traced. Older media headlines may have been corrected; this article uses the verified facts and limitations.

Header Accordions: QPACK amplification attacks against HTTP/3 servers

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of modular container equipment and a tray with a defined boundaryIllustrationSecurity updates · 2026.10.26

Amazon Linux updates its Docker security advisory: check container hosts and archive handling

Amazon LinuxIllustration of a female bakery owner checking online orders and receiptsIllustrationVulnerability advisories · 2026.10.25

PHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause

PHP / Palo Alto Networks Unit 42Original synthetic illustration of an archive system administrator checking a server maintenance checklistIllustrationThreat Advisories · 2026.10.24

Linux KSMBD file-sharing issue disclosed: first check whether the service is enabled

CSIRT.SK / Sysdig