x.com/4A4133/status/2113008219891109996
1 correction found
0-Day vuln in QUIC
The disclosed bugs are in HTTP/3/QPACK implementations layered on top of QUIC, not in the QUIC transport protocol itself.
Full reasoning
The underlying disclosure does not describe a vulnerability in QUIC itself.
- FoxIO's write-up is titled "QPACK amplification attacks against HTTP/3 servers" and says the finding affected "multiple HTTP/3 implementations".
- The same post explains that QPACK is the header-compression mechanism for HTTP/3, and explicitly distinguishes this from QUIC's role.
- The relevant standards do the same: RFC 9114 defines HTTP/3 as a mapping of HTTP over the QUIC transport protocol, and RFC 9204 is titled "QPACK: Field Compression for HTTP/3".
- A primary vendor advisory for one affected library (Cloudflare quiche) says the bug was in quiche's "HTTP/3 layer" and involved QPACK decompression limits.
So the accurate description is that these were HTTP/3/QPACK resource-exhaustion bugs in certain implementations that use QUIC, not a generic QUIC protocol 0-day.
4 sources
- Header Accordions: QPACK amplification attacks against HTTP/3 servers - FoxIO | Cyber Innovation
The post says the finding affected “multiple HTTP/3 implementations” and discusses QPACK compression in HTTP/3.
- RFC 9114: HTTP/3
RFC 9114 says HTTP/3 is “a mapping of HTTP semantics over the QUIC transport protocol.”
- RFC 9204 - QPACK: Field Compression for HTTP/3
RFC 9204 is titled “QPACK: Field Compression for HTTP/3.”
- Resource exhaustion in HTTP/3 and QPACK · Advisory · cloudflare/quiche · GitHub
Cloudflare’s advisory says quiche’s “HTTP/3 layer” was vulnerable and that QPACK decompression limits were not applied correctly.