New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
Publié le
Par The Hacker News
NEW QPACK FLAWS CAN CRASH HTTP/3 SERVERS, TRIGGER UP TO 4,000-FOLD MEMORY AMPLIFICATION
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code. By sending a small batch of compressed HTTP headers that expands in memory to a much larger set, the attacker can force the ser
IMPACTS POUR LES ORGANISATIONS
- ▸Non-conformité réglementaire exposant à des sanctions financières.
- ▸Atteinte à la réputation et perte de confiance des parties prenantes.
- ▸Obligation de mise en conformité sous contrainte de délais.
▶ ÉVALUATION DE LA CONFORMITÉ ET MISE EN PLACE DES MESURES CORRECTIVES
Source : The Hacker News
SECURITRUST
Source
Article original publié par The Hacker News : New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification