A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code. By sending a small batch of compressed HTTP headers that expands in memory to a much larger set, the attacker can force the server to use thousands of times more memory than it received, enough to run a default server
New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
About this summary. This is a short excerpt from the description that The Hacker News published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://thehackernews.com/2026/10/new-qpack-flaws-can-crash-http3-servers.html
Source attribution: headline and facts are from The Hacker News (thehackernews.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit.
Bellini Capital CISO on AI security governance and the limits of patching faster
In this Help Net Security interview, Brian Blakley, CISO at Bellini Capital, explains why AI makes finding vulnerabilities faster while fixing them still takes time. He…
Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers
Tailscale has released version 1.104.4 to fix flaws in its built-in SSH server that could let an attacker reach services and files on other servers that only the root…
Bringing Hardware Security Education to All: A Seamless Curriculum Integration Approach
arXiv:2610.36219v1 Announce Type: new Abstract: Cybersecurity education has predominantly focused on software and network security, under the assumption that the…
PHP2Shell and the Future of AI-Discovered Vulnerability Disclosure: Evidence, Verification, and Human Authority
arXiv:2610.36334v1 Announce Type: new Abstract: AI-assisted vulnerability discovery can produce technically plausible findings faster than maintainers can validate…
Silent Blindness: Fault Vulnerability of Hardware Malware Detectors
arXiv:2610.36612v1 Announce Type: new Abstract: Hardware malware detectors (HMDs) classify hardware performance-counter measurements to identify malicious execution…