One connection is enough to crash most HTTP/3 servers, thanks to QPACK header amplification
Qpack amplification attacks against HTTP/3 servers
A remote, unauthenticated client can send a tiny HEADERS frame that forces an HTTP/3 server to allocate thousands of times more memory than it received. Seven of ten tested implementations were vulnerable, including quic-go, Cloudflare quiche, lsquic, Bun, aioquic/mitmproxy, the h3 crate, and Wireshark. The root cause is missing or late-enforced decoded-header limits. quic-go, quiche, lsquic, and Wireshark are patched; Bun, h3, and aioquic remain unpatched.
A single stream carrying ~516 KiB of wire (528,500 indexed references) leaves the server pinned at 100% CPU and it never recovers, blocking out new incoming requests.