per-chunk-amplification wiki
55 pages in this category
HTTP
-
chunkloris: actix-web (h2c)
May 22, 2026 • updated
HTTP/2 (h2c) DATA frames. actix-web (h2c) 4.x. verdict: batches correctly.
-
chunkloris: actix-web
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. actix-web 4.x. verdict: vulnerable per chunk.
-
chunkloris: aioquic HTTP/3 example-style server
May 22, 2026 • updated
HTTP/3 DATA frames over QUIC. aioquic HTTP/3 example-style server aioquic 1.3.0. verdict: vulnerable per frame.
-
chunkloris: axum (on hyper)
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. axum (on hyper) 0.7 / hyper 1.x. verdict: vulnerable per chunk.
-
chunkloris: bandit (h2c)
May 22, 2026 • updated
HTTP/2 (h2c) DATA frames. bandit (h2c) 1.11.1. verdict: vulnerable per frame.
-
chunkloris: bandit
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. bandit 1.11.1. verdict: vulnerable per chunk.
-
chunkloris: cowboy (h2c)
May 22, 2026 • updated
HTTP/2 (h2c) DATA frames. cowboy (h2c) 2.15.0 (cowlib 2.16.1, ranch 2.2.0). verdict: protected h2 goaway.
-
chunkloris: cowboy
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. cowboy 2.15.0 (cowlib 2.16.1, ranch 2.2.0). verdict: vulnerable per chunk.
-
chunkloris: daphne
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. daphne 4.x. verdict: vulnerable per chunk.
-
chunkloris: Kestrel ASP.NET Core WebSockets
May 22, 2026 • updated
WebSocket text frames. Kestrel ASP.NET Core WebSockets ASP.NET Core 9.0 (mcr.microsoft.com/dotnet/aspnet:9.0); Microsoft.AspNetCore.WebSockets. verdict: batches correctly.
-
chunkloris: express
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. express 5.2.1. verdict: vulnerable per chunk.
-
chunkloris: falcon (h2c)
May 22, 2026 • updated
HTTP/2 (h2c) DATA frames. falcon (h2c) 0.49.0. verdict: vulnerable per frame.
-
chunkloris: falcon (on async-http / protocol-http1)
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. falcon (on async-http / protocol-http1) 0.49.0. verdict: vulnerable per chunk.
-
chunkloris: fastify (h2c)
May 22, 2026 • updated
HTTP/2 (h2c) DATA frames. fastify (h2c) 5.8.5. verdict: vulnerable per frame.
-
chunkloris: fastify
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. fastify 5.x. verdict: vulnerable per chunk.
-
chunkloris: gin
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. gin 1.10.1. verdict: vulnerable per chunk.
-
chunkloris: gorilla/websocket
May 22, 2026 • updated
WebSocket text frames. gorilla/websocket v1.5.3 on go 1.23. verdict: batches correctly.
-
chunkloris: Go net/http + golang.org/x/net/http2 (h2c)
May 22, 2026 • updated
HTTP/2 (h2c) DATA frames. Go net/http + golang.org/x/net/http2 (h2c) go 1.23 + x/net v0.30. verdict: vulnerable per frame.
-
chunkloris: net/http (stdlib)
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. net/http (stdlib) go-1.23.12. verdict: vulnerable per chunk.
-
chunkloris: quic-go HTTP/3
May 22, 2026 • updated
HTTP/3 DATA frames over QUIC. quic-go HTTP/3 quic-go v0.54.0. verdict: vulnerable per frame.
-
chunkloris: granian (ASGI h2c)
May 22, 2026 • updated
HTTP/2 (h2c) DATA frames. granian (ASGI h2c) 1.7.6. verdict: vulnerable per frame.
-
chunkloris: granian
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. granian 1.x. verdict: vulnerable per chunk.
-
chunkloris: gunicorn
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. gunicorn 23.0.0. verdict: vulnerable per chunk.
-
chunkloris: HAProxy (h2c frontend)
May 22, 2026 • updated
HTTP/2 (h2c) DATA frames. HAProxy (h2c frontend) 3.0.23. verdict: vulnerable per frame.
-
chunkloris: HAProxy (with Lua applet for body sink)
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. HAProxy (with Lua applet for body sink) 3.0.23. verdict: vulnerable per chunk.
-
chunkloris: http/1 vs http/2 vs http/3
May 22, 2026 • updated
how the per-chunk amplification shape changes (and does not change) across http/1.1 chunked transfer encoding, http/2 data frames, and http/3 data frames over quic
-
chunkloris: Apache httpd mod_http2 (h2c)
May 22, 2026 • updated
HTTP/2 (h2c) DATA frames. Apache httpd mod_http2 (h2c) 2.4.67. verdict: vulnerable per frame.
-
chunkloris: Apache httpd (event MPM + mod_lua)
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. Apache httpd (event MPM + mod_lua) 2.4.67. verdict: vulnerable per chunk.
-
chunkloris: hypercorn
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. hypercorn 0.17.3. verdict: vulnerable per chunk.
-
chunkloris: hypercorn
May 22, 2026 • updated
HTTP/2 (h2c) DATA frames. hypercorn 0.17.3. verdict: vulnerable per frame.
-
chunkloris: hypercorn (HTTP/3)
May 22, 2026 • updated
HTTP/3 DATA frames over QUIC. hypercorn (HTTP/3) 0.17.3 + aioquic 1.3.0. verdict: vulnerable per frame.
-
chunkloris: Kestrel
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. Kestrel 9.0 (Microsoft.AspNetCore 9.0; bundled in mcr.microsoft.com/dotnet/aspnet:9.0). verdict: batches correctly.
-
chunkloris: Kestrel (ASP.NET Core 9, h2c)
May 22, 2026 • updated
HTTP/2 (h2c) DATA frames. Kestrel (ASP.NET Core 9, h2c) 9.0. verdict: vulnerable per frame.
-
chunkloris: Kestrel (ASP.NET Core 9, HTTP/3)
May 22, 2026 • updated
HTTP/3 DATA frames over QUIC. Kestrel (ASP.NET Core 9, HTTP/3) ASP.NET Core 9.0 + MsQuic. verdict: vulnerable per frame.
-
chunkloris: nginx/openresty (h2c)
May 22, 2026 • updated
HTTP/2 (h2c) DATA frames. nginx/openresty (h2c) 1.29.2.3 / openresty:alpine. verdict: vulnerable per frame.
-
chunkloris: nginx (openresty distribution)
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. nginx (openresty distribution) 1.29.2.3 / openresty:alpine. verdict: vulnerable per chunk.
-
chunkloris: node http2 (native)
May 22, 2026 • updated
HTTP/2 (h2c) DATA frames. node http2 (native) node-22. verdict: vulnerable per frame.
-
chunkloris: node http.Server (built-in)
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. node http.Server (built-in) node-22.22.3. verdict: vulnerable per chunk.
-
chunkloris: ws (Node)
May 22, 2026 • updated
WebSocket text frames. ws (Node) ws 8.18.0 on node 22-slim. verdict: batches correctly.
-
chunkloris: phoenix on cowboy (h2c)
May 22, 2026 • updated
HTTP/2 (h2c) DATA frames. phoenix on cowboy (h2c) Phoenix 1.8.7 / plug_cowboy 2.8.1 / cowboy 2.15.0. verdict: protected h2 goaway.
-
chunkloris: phoenix
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. phoenix 1.7 on plug_cowboy 2.7 / cowboy 2.15.0. verdict: vulnerable per chunk.
-
chunkloris: puma
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. puma 6.4.3. verdict: vulnerable per chunk.
-
chunkloris: uvicorn (websockets impl)
May 22, 2026 • updated
WebSocket text frames. uvicorn (websockets impl) uvicorn 0.32.1, websockets 13.1, starlette 0.41.3. verdict: vulnerable per frame.
-
chunkloris: uvicorn (wsproto impl)
May 22, 2026 • updated
WebSocket text frames. uvicorn (wsproto impl) uvicorn 0.32.1, wsproto 1.2.0, starlette 0.41.3. verdict: vulnerable per frame.
-
chunkloris: hyper 1.5 + h2 0.4 (h2c)
May 22, 2026 • updated
HTTP/2 (h2c) DATA frames. hyper 1.5 + h2 0.4 (h2c) hyper 1.5 / h2 0.4. verdict: batches correctly.
-
chunkloris: tokio-tungstenite
May 22, 2026 • updated
WebSocket text frames. tokio-tungstenite 0.24 on rust 1.83. verdict: batches correctly.
-
chunkloris: Spring Boot + Tomcat
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. Spring Boot + Tomcat spring-boot-3.3.5 / tomcat-10.1. verdict: vulnerable per chunk.
-
chunkloris: Spring Boot + Tomcat (h2c)
May 22, 2026 • updated
HTTP/2 (h2c) DATA frames. Spring Boot + Tomcat (h2c) spring-boot-3.3.5 / tomcat-10.1. verdict: protected h2 goaway.
-
chunkloris: tornado
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. tornado 6.4.2. verdict: vulnerable per chunk.
-
chunkloris: unicorn
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. unicorn 6.1.0. verdict: vulnerable per chunk.
-
chunkloris: uvicorn
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. uvicorn 0.32.1. verdict: vulnerable per chunk.
-
chunkloris: uvicorn
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. uvicorn 0.32.1. verdict: vulnerable per chunk.
-
chunkloris: Vert.x 4.5 (Netty h2c)
May 22, 2026 • updated
HTTP/2 (h2c) DATA frames. Vert.x 4.5 (Netty h2c) 4.5.10. verdict: batches correctly.
-
chunkloris: Vert.x
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. Vert.x 4.5.10. verdict: vulnerable per chunk.
-
chunkloris: waitress
May 22, 2026 • updated
HTTP/1.1 chunked transfer encoding. waitress 3.0.2. verdict: vulnerable per chunk.