Qpack amplification attacks against HTTP/3 servers
Summary
This post analyzes QPACK amplification attacks against HTTP/3 servers, showing how a remote, unauthenticated client can force extreme memory usage during header decoding. It surveys multiple implementations (quic-go, quiche, lsquic, Bun, aioquic/mitmproxy, h3, Wireshark), lists CVEs, and outlines mitigations such as SETTINGS_MAX_FIELD_SECTION_SIZE and per-header budgets. The article emphasizes enforcing decoded-header budgets during decoding rather than relying on frame size checks.