A significant security vulnerability has been identified in HTTP/3 servers, allowing remote attackers to crash these servers using a single connection. This revelation, brought to light by security experts at FoxIO, includes a proof-of-concept code demonstrating the flaw.
Understanding the QPACK Flaws
The vulnerability stems from QPACK, a compression mechanism used in HTTP/3 for request headers. Attackers can exploit this by sending a compressed set of HTTP headers that expand dramatically in memory, causing the server to allocate exponentially more memory than anticipated. This can lead to denial-of-service attacks, though no data breaches or executions of unauthorized code have been reported.
Currently, patches have been issued for several affected stacks, including quic-go, Cloudflare quiche, lsquic, and Wireshark. However, other libraries such as Bun, the h3 Rust library, and aioquic remain vulnerable as of the latest update.
Impact and Mitigation
FoxIO’s investigation revealed similar flaws in seven out of ten HTTP/3 stacks tested. These vulnerabilities occur because affected servers inadequately cap the size of unpacked headers, allowing a single request to dramatically inflate the number of header entries held in memory.
These vulnerabilities impact widely used software stacks, such as those under Caddy, Traefik, and cloudflared, highlighting the broad reach and potential impact of these flaws. Since HTTP/3 operates over UDP, malicious requests can bypass many conventional filtering mechanisms.
Patches and Preventive Measures
Efforts to address these vulnerabilities have led to fixes for some stacks. For instance, updates are available for quic-go, Cloudflare quiche, and lsquic, among others. However, for unpatched systems, FoxIO recommends interim measures. For Bun, avoiding exposure of its HTTP/3 server is advised. In the case of mitmproxy, disabling HTTP/3 is suggested, and for the h3 Rust library, setting a reasonable limit on header memory is crucial.
The issue with Wireshark differs, as it pertains to the HTTP/3 dissector component crashing during decryption processes, rather than being a direct server vulnerability accessible by attackers.
Looking Ahead
The discovery of these vulnerabilities underscores the importance of continuous security assessments and prompt updates to mitigate risks. The work to address these flaws began following earlier research into similar vulnerabilities in HTTP/2. As the landscape of web protocols evolves, maintaining a proactive stance on security is essential to safeguarding against potential threats.
