A single connection can exhaust HTTP/3 server memory through QPACK flaws
On October 22, 2026, FoxIO showed that one unauthenticated connection can inflate an HTTP/3 server’s memory usage by up to 4,000×, enough to trigger denial of service. Patch quic-go, quiche and lsquic now, and disable HTTP/3 on the stacks that are still exposed.