Xavfsizlik firmasi FoxIO ma'lum qilishicha, tizimga kirmagan masofaviy hujumchi bitta ulanish bilan ko'plab HTTP/3 veb-serverlarini ishdan chiqarishi mumkin; u ishlaydigan isbot-kodini ham e'lon qildi.
Hujumchi siqilgan HTTP sarlavhalarining kichik to'plamini yuborib, u xotirada ancha katta to'plamga kengayadi va serverni qabul qilgan baytlardan minglab marta ko'proq xotira ishlatishga majbur qiladi — bu esa standart serverni xotiradan chiqarib yuborish uchun yetarli.
Bu zaifliklar faqat xizmatdan voz kechish (DoS) hujumlarini keltirib chiqaradi; ma'lumot o'g'irlash yoki kod bajarish dalillari yo'q va yovvoyi muhitda hujumlar haqida ochiq xabarlar yo'q. quic-go, Cloudflare quiche, lsquic va Wireshark uchun tuzatishlar chiqqan, ammo e'lon paytida Bun, h3 Rust kutubxonasi va aioquic hali tuzatilmagan edi.
FoxIO sinovdan o'tkazgan o'nta HTTP/3 stekdan yettitasida shu turdagi zaiflikni topdi. Umumiy sabab — HTTP/3 sarlavhalarni siqish uchun ishlatadigan QPACK sxemasida. Takrorlanadigan maydonlar to'liq matn o'rniga qisqa kod sifatida yuboriladi.
Server ochilgan sarlavhalar hajmini cheklashi kerak. Ta'sirlangan steklar sim orqali kelgan siqilgan to'plamni cheklaydi, lekin ochilgan natijani emas, yoki cheklovni juda kech qo'llaydi; shuning uchun bitta so'rov server xotirada saqlaydigan yuz minglab sarlavha yozuvlariga kengayishi mumkin.
Bu steklar keng tarqalgan dasturiy ta'minot ostida ishlaydi, shuning uchun ta'sir keng. quic-go — Caddy, Traefik va cloudflared ostidagi Go kutubxonasi; lsquic — LiteSpeed kutubxonasi, LiteSpeed Web Server va OpenLiteSpeed'da ishlatiladi; Bun'ning HTTP/3 serveri esa lsquic'da ishlaydi.
Hujumchiga hisob yoki maxsus ruxsat kerak emas; HTTP/3 UDP orqali ishlagani uchun so'rov odatiy filtrlashdan oldin serverga yetib boradi.
2026-yil 22-oktabr holatiga ko'ra qaysi steklar tuzatilgan va qaysilari hali ochiq:
| Stack | Holat | Tuzatilgan versiya | Identifikator |
|---|---|---|---|
| quic-go | Tuzatilgan | 0.57.0 | CVE-2025-64702 |
| Cloudflare quiche | Tuzatilgan | 0.29.3 | CVE-2026-12523 |
| lsquic | Tuzatilgan | 4.9.0 | CVE yo'q |
| Wireshark | Tuzatilgan | 4.6.2 / 4.4.12 | CVE-2025-13945 |
| Bun | Tuzatilmagan | — | CVE yo'q |
| h3 (hyperium) | Tuzatilmagan | — | CVE yo'q |
| aioquic / mitmproxy | Tuzatilmagan | — | CVE yo'q |
FoxIO IIS, Envoy, ngtcp2/nghttp3 va Google'ning quiche'ini ta'sirlanmagan deb ro'yxatga olgan; har biri ochish jarayonida ochilgan sarlavhalarni cheklaydi, keyin emas.
Kengayish stek bo'yicha farq qiladi (FoxIO o'z sinovlarida standart sozlamalar bilan). quic-go'da 1 MB siqilgan to'plam taxminan 160 000 sarlavha maydoniga ochilib, so'rovda taxminan 15 MB xotira egallaydi — yuborilgan baytlardan taxminan 17 baravar; quic-go'ning o'z maslahatida mumkin kengayish taxminan 50 baravar deb ko'rsatilgan.
Ikkinchi usul nisbatni ancha yuqori qiladi: hujumchi taxminan 4 KB hajmdagi bitta sarlavha yozuvini saqlaydi, so'ngra minglab marta bir baytli havolalar bilan unga ishora qiladi; server har bir havolada to'liq yozuvni qayta quradi. FoxIO Bun'da taxminan 4000 baravar, lsquic'da esa 600 dan 1800 baravargacha o'lchagan.
Bun eng yomon holatni ko'rsatadi. Uning HTTP/3 serveri (Bun hujjatlarida eksperimental deb ataladi) lsquic'dan foydalanadi, lekin sarlavha xotirasini cheklaydigan qismni o'z kodi bilan almashtiradi; bu kod har bir sarlavhani tekshiradi, lekin umumiy yig'indini emas. FoxIO aniqlashicha, ochilgan sarlavhalar 2 GB'dan oshganda, shu koddagi o'lcham hisoblagichi nolga to'lib ketadi va server hech qachon chiqmaydigan tsiklga kiradi.
FoxIO xabar berishicha, sim orqali taxminan 516 KB olib keladigan bitta oqim serverni 100 foiz CPU'da qoldiradi, tiklanishsiz, yangi so'rovlarni bloklaydi. Umumiy yig'indi yo'qligi tufayli to'lib ketish mumkin; lsquic'ning o'z 64 KB cheklovi buni oldini oladi.
Wireshark server zaifliklaridan farqli holat. Uning muammosi HTTP/3 dissektorini (tarmoqdan ushlangan trafikni o'qiydigan qismni) ishdan chiqaradi; bu Wireshark kalit-log fayli yordamida trafikni shifrlaganda yoki shifrlash sirlarini o'z ichiga olgan ushlash faylini ochganda sodir bo'ladi. Bu tarmoq orqali hujumchi yetib boradigan server emas. Wireshark "bu muammo uchun hech qanday ekspluatatsiya haqida bilmaymiz" deb aytgan.
Operatorlar yuqoridagi tuzatilgan versiyalarga yangilanishi kerak. Tuzatish yo'q steklar uchun FoxIO vaqtinchalik choralarni beradi: Bun'da HTTP/3 serverini ochiq qoldirmang; mitmproxy'da --set http3=false parametri bilan HTTP/3'ni o'chiring; h3 Rust kutubxonasi uchun esa maxfieldsection_size bilan maqbul cheklov o'rnating.
2026-yil 16-iyulda chiqqan lsquic tuzatishi har bir oqimda server saqlaydigan ochilgan sarlavha to'plamlari sonini cheklaydi, standart bo'yicha bitta. FoxIO aytishicha, bu ish Gal Bar Nahumning HTTP/2'ga qarshi "MadeYouReset" nomli xizmatdan voz kechish texnikasi bo'yicha tadqiqotidan keyin boshlangan; u HTTP/3 sarlavha siqishida ham shunga o'xshash zaiflik bormi, deb so'ragan.
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code.
By sending a small batch of compressed HTTP headers that expands in memory to a much larger set, the attacker can force the server to use thousands of times more memory than it received, enough to run a default server out of memory.
The flaws cause only denial-of-service attacks, with no evidence of data theft or code execution and no public reports of attacks in the wild. Fixes are out for quic-go, Cloudflare quiche, lsquic and Wireshark, but Bun, the h3 Rust library and aioquic were still unpatched at disclosure.
FoxIO found the same class of flaw in seven of ten HTTP/3 stacks it tested. The common cause is in QPACK, the scheme HTTP/3 uses to compress request headers so repeated fields travel as a short code instead of the full text.
A server is supposed to cap the size of the headers after it unpacks them. The affected stacks cap the compressed batch that arrives on the wire, but not the unpacked result, or they apply the cap too late, so a single request can expand into hundreds of thousands of header entries that the server holds in memory.
The reach is wide because these stacks sit under common software. quic-go is the Go library behind Caddy, Traefik and cloudflared; lsquic is LiteSpeed's library, used in LiteSpeed Web Server and OpenLiteSpeed; and Bun's HTTP/3 server runs on lsquic.
The attacker needs no account or special access, and since HTTP/3 runs over UDP, the request reaches the server before much of the usual filtering applies.
Which stacks are fixed and which are still exposed, as of October 22, 2026:
| Stack | Status | Fixed version | Identifier |
|---|---|---|---|
| quic-go | Fixed | 0.57.0 | CVE-2025-64702 |
| Cloudflare quiche | Fixed | 0.29.3 | CVE-2026-12523 |
| lsquic | Fixed | 4.9.0 | no CVE |
| Wireshark | Fixed | 4.6.2 / 4.4.12 | CVE-2025-13945 |
| Bun | Unpatched | — | no CVE |
| h3 (hyperium) | Unpatched | — | no CVE |
| aioquic / mitmproxy | Unpatched | — | no CVE |
FoxIO lists IIS, Envoy, ngtcp2/nghttp3, and Google's quiche as not affected, each because it caps the unpacked headers while decoding rather than after.
The amplification varies by stack, in FoxIO's own tests against default settings. On quic-go, a 1 MB compressed batch unpacked into about 160,000 header fields and left roughly 15 MB held in the request, about 17 times the bytes sent; quic-go's own advisory puts the possible expansion at around 50 times.
A second method drives the ratio much higher: the attacker stores one roughly 4 KB header entry, then points at it thousands of times using one-byte references, and the server rebuilds the full entry on each reference. FoxIO measured about 4,000 times on Bun and between 600 and 1,800 times on lsquic.
Bun carries a worst-case. Its HTTP/3 server, which Bun's documentation calls experimental, uses lsquic but replaces the part that caps header memory with its own code, which checks each header but never the running total. FoxIO found that once the unpacked headers pass 2 GB, a size counter in that code overflows to zero and the server enters a loop it never leaves.
A single stream carrying about 516 KB on the wire, FoxIO reported, leaves the server stuck at 100 percent CPU with no recovery, blocking new requests. The missing running total is what lets the overflow be reached; lsquic's own 64 KB cap prevents it.
Wireshark is a different case from the server flaws. Its issue crashes the HTTP/3 dissector, the part that reads HTTP/3 out of a capture, when Wireshark decrypts traffic using a key-log file or opens a capture file that holds decryption secrets. It is not a server an attacker reaches over the network. Wireshark said it is "unaware of any exploits for this issue."
Operators should upgrade to the fixed releases above. For the stacks with no fix, FoxIO gives interim steps: on Bun, do not expose an HTTP/3 server; on mitmproxy, turn off HTTP/3 by passing --set http3=false; and for the h3 Rust library, set a sensible limit with maxfieldsection_size.
The lsquic fix, released July 16, 2026, caps how many unpacked header sets a server holds per stream, defaulting to one. FoxIO said the work began after Gal Bar Nahum's research into "MadeYouReset," a denial-of-service technique against HTTP/2, which asked whether HTTP/3's header compression had a similar weakness.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.