negativeSYS.SOURCE: The Hacker News• 2026-10-22T12:08:31+05:30

QPACK Vulnerabilities in HTTP/3 Enable Memory Amplification Attacks

#http3 #qpack #vulnerability

A newly disclosed vulnerability in HTTP/3's QPACK protocol allows remote attackers to crash servers by exploiting memory amplification through compressed headers. The flaw enables a single connection to force excessive memory usage, potentially leading to server failure.

A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code.

By sending a small batch of compressed HTTP headers that expands in memory to a much larger set, the attacker can force the server to use thousands of times more memory than it received, enough to run a default server

Read original article

*** END OF TRANSMISSION ***

> OPTIMIZING MAP POLYGON TRIANGULATION: 3.7M POLYGONS PROCESSED IN 489 MS USING EARSTRIP > COMPROMISED INTERMEDIATE CERTIFICATE AUTHORITY VULNERABILITY CVE-2026-111943 > EXPLORING NON-LLM APPROACHES FOR AI REASONING > LITELLM INVESTIGATES GITHUB TOKEN LEAK LEADING TO MALICIOUS AI PACKAGE RELEASE > CRITICAL REMOTE CODE EXECUTION VULNERABILITY IN NODE.JS BROTLI DECODER ACROSS ALL SUPPORTED VERSIONS > QPACK VULNERABILITIES IN HTTP/3 ENABLE MEMORY AMPLIFICATION ATTACKS > EXPLOIT ATTEMPT TARGETING PHP2SHELL VULNERABILITIES DETECTED FOUR DAYS BEFORE PUBLIC DISCLOSURE > OFFICIAL OPENAI CLI TOOL FOR API INTERACTION > CHINA-LINKED THREAT GROUP STORM-0940 EXPLOITS ARTEX AI FRAMEWORK IN CONNECTWISE SUPPLY CHAIN ATTACK > OPTIMAL O(N LOG N) INTEGER MULTIPLICATION ALGORITHM PROPOSED> OPTIMIZING MAP POLYGON TRIANGULATION: 3.7M POLYGONS PROCESSED IN 489 MS USING EARSTRIP > COMPROMISED INTERMEDIATE CERTIFICATE AUTHORITY VULNERABILITY CVE-2026-111943 > EXPLORING NON-LLM APPROACHES FOR AI REASONING > LITELLM INVESTIGATES GITHUB TOKEN LEAK LEADING TO MALICIOUS AI PACKAGE RELEASE > CRITICAL REMOTE CODE EXECUTION VULNERABILITY IN NODE.JS BROTLI DECODER ACROSS ALL SUPPORTED VERSIONS > QPACK VULNERABILITIES IN HTTP/3 ENABLE MEMORY AMPLIFICATION ATTACKS > EXPLOIT ATTEMPT TARGETING PHP2SHELL VULNERABILITIES DETECTED FOUR DAYS BEFORE PUBLIC DISCLOSURE > OFFICIAL OPENAI CLI TOOL FOR API INTERACTION > CHINA-LINKED THREAT GROUP STORM-0940 EXPLOITS ARTEX AI FRAMEWORK IN CONNECTWISE SUPPLY CHAIN ATTACK > OPTIMAL O(N LOG N) INTEGER MULTIPLICATION ALGORITHM PROPOSED