New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification

Security researchers have disclosed QPACK vulnerabilities affecting HTTP/3 web servers. An unauthenticated remote attacker can exploit compressed header logic to trigger massive memory amplification, crashing vulnerable servers through resource exhaustion with minimal input traffic.