Qpack amplification attacks against HTTP/3 servers

A remote attacker can exploit QPACK header compression in HTTP/3 servers to cause memory exhaustion attacks, with a small encoded request expanding into hundreds of thousands of header objects that consume tens to thousands of times more memory than the original data sent. Seven out of ten tested HTTP/3 implementations are vulnerable due to missing, incomplete, or improperly enforced decoded-header size limits, allowing a single connection to crash a default-configured server. Several implementations have already been patched with fixes that properly enforce cumulative memory budgets during header decoding.