Security firm FoxIO has disclosed new QPACK flaws that can crash many HTTP/3 web servers with a single unauthenticated connection. By sending a small batch of crafted, compressed HTTP headers, an attacker can force the server to expand them into a much larger memory footprint, leading to up to 4,000-fold memory amplification. This can exhaust server resources and cause a denial of service, impacting the availability of HTTP/3 services.