Researcher reproduces QPACK amplification in aioquic: 54 KB expands to 200 MB
A researcher hand-built an exploit for FoxIO's Header Accordions class of QPACK amplification attacks, disclosed October 20, and tested it on aioquic 1.7.0 with pylsqpack 1.0.0. A 54 KB header block decoded into 200.5 million bytes in 284 ms with 207 MB peak memory; aioquic enforces neither field count nor total size, and SETTINGS_MAX_FIELD_SECTION_SIZE is defined but never sent or checked.
- Amplification reached 3712x: 54,009 wire bytes produced 200.5 million decoded bytes
- Decoding took 284 ms with 207 MB peak decoder memory
- Seven of ten tested stacks were vulnerable; Bun, Rust h3 and aioquic had no fix at disclosure
- For mitmproxy with HTTP/3 the documented workaround is --set http3=false
Read next
Security