HTTP/3服务器QPACK放大攻击漏洞被曝光

研究人员发现HTTP/3服务器在QPACK头部压缩实现中存在严重放大攻击漏洞1。远程未认证客户端可通过精心构造的请求强制服务器分配数十到数千倍于发送流量的内存，单个连接足以导致默认配置下服务器内存溢出或服务挂起1。在调查的十个HTTP/3实现中，七个存在此漏洞1。

漏洞的根本原因在于服务器在解码头部时未正确强制执行累积大小限制1。以1,000,000字节的HEADERS帧为例，该漏洞允许攻击者在其中包含约160,000个唯一头部1。不同实现存在各异的具体表现：quic-go（被Caddy、Traefik和cloudflared所采用的Go库）将1 MiB限制应用于压缩负载而非解码输出，导致15倍扩大1；Cloudflare的quiche库在计算开销时漏算RFC规定的32字节头部开销，允许33倍更多的头部通过1；采用lsquic的动态表参考产生4064:1的放大率1。Bun移除了64 KiB的累积限制，使单个连接可导致2GiB容器内存溢出，同时存在整数溢出漏洞——ncap超过2^31后变为0，导致永久无限循环和CPU占用率100%的服务挂起1。aioquic与mitmproxy定义了MAX_FIELD_SECTION_SIZE参数但从未在解码时进行检查1，而h3 crate在HeaderMap容量超出时触发程序崩溃1。

nghttp3、IIS、Envoy和ngtcp2不受影响1。研究人员指出，修复方案要求在解码时逐条检查头部大小，计入RFC规定的32字节开销，并应用累积预算限制1。多个受影响实现已发布补丁1。

Researchers have discovered critical amplification vulnerabilities in QPACK header compression used by HTTP/3 servers, allowing unauthenticated remote clients to force servers to allocate memory at rates tens to thousands of times greater than the traffic they send.1 A single connection is sufficient to trigger out-of-memory conditions or service hangs on servers using default configurations.1 Seven of ten analyzed HTTP/3 implementations contain the vulnerability, with multiple vendors already releasing patches.1

The root cause lies in servers failing to properly enforce cumulative size limits during header decoding.1 The vulnerability manifests differently across implementations. The quic-go library, used in Caddy, Traefik, and cloudflared, applies its 1 MiB limit to the compressed payload rather than the decoded output, resulting in a 15-fold amplification factor.1 Cloudflare's quiche implementation miscalculates overhead by omitting the 32-byte RFC requirement, allowing 33 times more headers to pass validation.1 The lsquic library produces a 4064:1 amplification ratio through dynamic table references.1 Notably, Bun removes lsquic's 64 KiB cumulative limit entirely, enabling a single connection to cause a 2 GiB container to run out of memory.1 Additionally, Bun contains an integer overflow vulnerability where ncap exceeding 2^31 wraps to zero, triggering an infinite loop and 100 percent CPU consumption.1

The aioquic and mitmproxy projects define MAX_FIELD_SECTION_SIZE but never enforce it during decoding,1 while the h3 Rust crate panics when HeaderMap capacity is exceeded.1 A single 1,000,000-byte HEADERS frame can contain approximately 160,000 unique headers.1 Implementations including nghttp3, IIS, Envoy, and ngtcp2 are unaffected.1 Effective remediation requires checking sizes per header during decoding, including the RFC-mandated 32-byte header overhead, and applying cumulative budget constraints.1