Researcher says Bun did not answer May report on HTTP/3 flaw
Féry’s report describes memory exhaustion and a CPU lockup in Bun’s experimental, opt-in HTTP/3 server. His test results have not been independently replicated.
By Emerson Redding · Published
Why it matters
Féry’s account describes a way for a client to consume server memory or CPU through HTTP/3 traffic. Bun documents HTTP/3 as experimental and requires TLS and an explicit opt-in, limiting the finding to deployments that enable the feature.
FoxIO researcher Sébastien Féry said FoxIO reported a QPACK issue affecting Bun to the security contact listed in Bun’s policy on May 24th and never heard back.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.