HTTP/3 transport

What happened

A malformed QUIC frame sequence triggers unbounded allocation in several HTTP/3 implementations, taking servers down with a single connection.

Timeline

1. 18 Oct 2026 · 14:00 UTC

   Research

   Seven of ten tested implementations crash on the same frame.

2. 19 Oct 2026 · 09:00 UTC

   Mitigation

   Vendors publish rate limits and frame-size caps.

3. 22 Oct 2026 · 11:00 UTC

   Still patchy

   Several small hosts remain unpatched a week later.

Sources

• IETF QUIC working groupdatatracker.ietf.org