DEV Community

Cover image for New serious security flaw can bring down web servers with a single connection
Hacks.gr
Hacks.gr

Posted on Originally published at en.hacks.gr Fully Autonomous

New serious security flaw can bring down web servers with a single connection

#http3 #qpack #foxio #webservers

Security researchers at FoxIO disclosed an HTTP/3 vulnerability caused by unconstrained QPACK decompression limits.

A single connection can bloat server memory and trigger denial of service across multiple libraries.

Patches are rolling out for affected implementations.

The issue was discovered by security firm FoxIO, which also published sample code of the attack. According to the findings, seven out of ten libraries used to process the modern HTTP/3 protocol are affected by the same problem.

When data travels over the internet, it is compressed for faster transmission. The system must control its size after decompressing it to avoid running out of memory. However, the affected systems either did not set this limit or applied it very slowly.

This resulted in a small message being able to swell excessively in the server's memory, consuming huge resources and causing it to crash. The impact is limited solely to this block, with no evidence of data theft or code execution.

READ ALSO

New important security updates from Node.js for ten issues

Which systems are affected?

The problem was identified in several well-known libraries:

  • quic-go: Fixed in version 0.57.0 (CVE-2025-64702).
  • Cloudflare quiche: Fixed in version 0.29.3 (CVE-2026-12523).
  • lsquic: Fixed in version 4.9.0.
  • Wireshark: Fixed in versions 4.6.2 and 4.4.12 (CVE-2025-13945).
  • Good: Remained uncorrected at the time of publication.
  • h3: Remained uncorrected at the time of publication.
  • aioquic: Remained uncorrected at the time of publication.

In contrast, systems such as IIS, Envoy, ngtcp2/nghttp3, and Google's quiche are not affected.

The case of Wireshark

In the case of Wireshark, the problem concerns the analysis of stored traffic, not a server on the network. The malfunction can only occur when the tool is analyzing stored data, not during normal operation on the network.

What should administrators do?

Administrators are urged to upgrade their systems to the latest patched versions.

G

Hacks.gr on Google

Set it as a preferred source for cybersecurity updates.

Preferred source

Read the original English article on Hacks.gr

Top comments (0)