per-chunk-amplification wiki

HTTP

• chunkloris: actix-web (h2c)

  May 22, 2026 • updated

  HTTP/2 (h2c) DATA frames. actix-web (h2c) 4.x. verdict: batches correctly.

  [http][h2][rust][chunkloris][per-chunk-amplification]+1 more

• chunkloris: actix-web

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. actix-web 4.x. verdict: vulnerable per chunk.

  [http][h1][rust][chunkloris][per-chunk-amplification]+1 more

• chunkloris: aioquic HTTP/3 example-style server

  May 22, 2026 • updated

  HTTP/3 DATA frames over QUIC. aioquic HTTP/3 example-style server aioquic 1.3.0. verdict: vulnerable per frame.

  [http][h3][python][chunkloris][per-chunk-amplification]+1 more

• chunkloris: axum (on hyper)

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. axum (on hyper) 0.7 / hyper 1.x. verdict: vulnerable per chunk.

  [http][h1][rust][chunkloris][per-chunk-amplification]+1 more

• chunkloris: bandit

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. bandit 1.11.1. verdict: vulnerable per chunk.

  [http][h1][beam][chunkloris][per-chunk-amplification]+1 more

• chunkloris: bandit (h2c)

  May 22, 2026 • updated

  HTTP/2 (h2c) DATA frames. bandit (h2c) 1.11.1. verdict: vulnerable per frame.

  [http][h2][beam][chunkloris][per-chunk-amplification]+1 more

• chunkloris: cowboy

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. cowboy 2.15.0 (cowlib 2.16.1, ranch 2.2.0). verdict: vulnerable per chunk.

  [http][h1][beam][chunkloris][per-chunk-amplification]+1 more

• chunkloris: cowboy (h2c)

  May 22, 2026 • updated

  HTTP/2 (h2c) DATA frames. cowboy (h2c) 2.15.0 (cowlib 2.16.1, ranch 2.2.0). verdict: protected h2 goaway.

  [http][h2][beam][chunkloris][per-chunk-amplification]+1 more

• chunkloris: daphne

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. daphne 4.x. verdict: vulnerable per chunk.

  [http][h1][python][chunkloris][per-chunk-amplification]+1 more

• chunkloris: Kestrel ASP.NET Core WebSockets

  May 22, 2026 • updated

  WebSocket text frames. Kestrel ASP.NET Core WebSockets ASP.NET Core 9.0 (mcr.microsoft.com/dotnet/aspnet:9.0); Microsoft.AspNetCore.WebSockets. verdict: batches correctly.

  [http][ws][dotnet][chunkloris][per-chunk-amplification]+1 more

• chunkloris: express

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. express 5.2.1. verdict: vulnerable per chunk.

  [http][h1][node][chunkloris][per-chunk-amplification]+1 more

• chunkloris: falcon (on async-http / protocol-http1)

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. falcon (on async-http / protocol-http1) 0.49.0. verdict: vulnerable per chunk.

  [http][h1][ruby][chunkloris][per-chunk-amplification]+1 more

• chunkloris: falcon (h2c)

  May 22, 2026 • updated

  HTTP/2 (h2c) DATA frames. falcon (h2c) 0.49.0. verdict: vulnerable per frame.

  [http][h2][ruby][chunkloris][per-chunk-amplification]+1 more

• chunkloris: fastify

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. fastify 5.x. verdict: vulnerable per chunk.

  [http][h1][node][chunkloris][per-chunk-amplification]+1 more

• chunkloris: fastify (h2c)

  May 22, 2026 • updated

  HTTP/2 (h2c) DATA frames. fastify (h2c) 5.8.5. verdict: vulnerable per frame.

  [http][h2][node][chunkloris][per-chunk-amplification]+1 more

• chunkloris: gin

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. gin 1.10.1. verdict: vulnerable per chunk.

  [http][h1][go][chunkloris][per-chunk-amplification]+1 more

• chunkloris: gorilla/websocket

  May 22, 2026 • updated

  WebSocket text frames. gorilla/websocket v1.5.3 on go 1.23. verdict: batches correctly.

  [http][ws][go][chunkloris][per-chunk-amplification]+1 more

• chunkloris: Go net/http + golang.org/x/net/http2 (h2c)

  May 22, 2026 • updated

  HTTP/2 (h2c) DATA frames. Go net/http + golang.org/x/net/http2 (h2c) go 1.23 + x/net v0.30. verdict: vulnerable per frame.

  [http][h2][go][chunkloris][per-chunk-amplification]+1 more

• chunkloris: net/http (stdlib)

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. net/http (stdlib) go-1.23.12. verdict: vulnerable per chunk.

  [http][h1][go][chunkloris][per-chunk-amplification]+1 more

• chunkloris: quic-go HTTP/3

  May 22, 2026 • updated

  HTTP/3 DATA frames over QUIC. quic-go HTTP/3 quic-go v0.54.0. verdict: vulnerable per frame.

  [http][h3][go][chunkloris][per-chunk-amplification]+1 more

• chunkloris: granian

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. granian 1.x. verdict: vulnerable per chunk.

  [http][h1][python][chunkloris][per-chunk-amplification]+1 more

• chunkloris: granian (ASGI h2c)

  May 22, 2026 • updated

  HTTP/2 (h2c) DATA frames. granian (ASGI h2c) 1.7.6. verdict: vulnerable per frame.

  [http][h2][python][chunkloris][per-chunk-amplification]+1 more

• chunkloris: gunicorn

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. gunicorn 23.0.0. verdict: vulnerable per chunk.

  [http][h1][python][chunkloris][per-chunk-amplification]+1 more

• chunkloris: HAProxy (with Lua applet for body sink)

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. HAProxy (with Lua applet for body sink) 3.0.23. verdict: vulnerable per chunk.

  [http][h1][c][chunkloris][per-chunk-amplification]+1 more

• chunkloris: HAProxy (h2c frontend)

  May 22, 2026 • updated

  HTTP/2 (h2c) DATA frames. HAProxy (h2c frontend) 3.0.23. verdict: vulnerable per frame.

  [http][h2][c][chunkloris][per-chunk-amplification]+1 more

• chunkloris: http/1 vs http/2 vs http/3

  May 22, 2026 • updated

  how the per-chunk amplification shape changes (and does not change) across http/1.1 chunked transfer encoding, http/2 data frames, and http/3 data frames over quic

  [http][http1][http2][http3][quic]+4 more

• chunkloris: Apache httpd (event MPM + mod_lua)

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. Apache httpd (event MPM + mod_lua) 2.4.67. verdict: vulnerable per chunk.

  [http][h1][c][chunkloris][per-chunk-amplification]+1 more

• chunkloris: Apache httpd mod_http2 (h2c)

  May 22, 2026 • updated

  HTTP/2 (h2c) DATA frames. Apache httpd mod_http2 (h2c) 2.4.67. verdict: vulnerable per frame.

  [http][h2][c][chunkloris][per-chunk-amplification]+1 more

• chunkloris: hypercorn

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. hypercorn 0.17.3. verdict: vulnerable per chunk.

  [http][h1][python][chunkloris][per-chunk-amplification]+1 more

• chunkloris: hypercorn

  May 22, 2026 • updated

  HTTP/2 (h2c) DATA frames. hypercorn 0.17.3. verdict: vulnerable per frame.

  [http][h2][python][chunkloris][per-chunk-amplification]+1 more

• chunkloris: hypercorn (HTTP/3)

  May 22, 2026 • updated

  HTTP/3 DATA frames over QUIC. hypercorn (HTTP/3) 0.17.3 + aioquic 1.3.0. verdict: vulnerable per frame.

  [http][h3][python][chunkloris][per-chunk-amplification]+1 more

• chunkloris: Kestrel

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. Kestrel 9.0 (Microsoft.AspNetCore 9.0; bundled in mcr.microsoft.com/dotnet/aspnet:9.0). verdict: batches correctly.

  [http][h1][dotnet][chunkloris][per-chunk-amplification]+1 more

• chunkloris: Kestrel (ASP.NET Core 9, h2c)

  May 22, 2026 • updated

  HTTP/2 (h2c) DATA frames. Kestrel (ASP.NET Core 9, h2c) 9.0. verdict: vulnerable per frame.

  [http][h2][dotnet][chunkloris][per-chunk-amplification]+1 more

• chunkloris: Kestrel (ASP.NET Core 9, HTTP/3)

  May 22, 2026 • updated

  HTTP/3 DATA frames over QUIC. Kestrel (ASP.NET Core 9, HTTP/3) ASP.NET Core 9.0 + MsQuic. verdict: vulnerable per frame.

  [http][h3][dotnet][chunkloris][per-chunk-amplification]+1 more

• chunkloris: nginx (openresty distribution)

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. nginx (openresty distribution) 1.29.2.3 / openresty:alpine. verdict: vulnerable per chunk.

  [http][h1][c][chunkloris][per-chunk-amplification]+1 more

• chunkloris: nginx/openresty (h2c)

  May 22, 2026 • updated

  HTTP/2 (h2c) DATA frames. nginx/openresty (h2c) 1.29.2.3 / openresty:alpine. verdict: vulnerable per frame.

  [http][h2][c][chunkloris][per-chunk-amplification]+1 more

• chunkloris: node http2 (native)

  May 22, 2026 • updated

  HTTP/2 (h2c) DATA frames. node http2 (native) node-22. verdict: vulnerable per frame.

  [http][h2][node][chunkloris][per-chunk-amplification]+1 more

• chunkloris: node http.Server (built-in)

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. node http.Server (built-in) node-22.22.3. verdict: vulnerable per chunk.

  [http][h1][node][chunkloris][per-chunk-amplification]+1 more

• chunkloris: ws (Node)

  May 22, 2026 • updated

  WebSocket text frames. ws (Node) ws 8.18.0 on node 22-slim. verdict: batches correctly.

  [http][ws][node][chunkloris][per-chunk-amplification]+1 more

• chunkloris: phoenix on cowboy (h2c)

  May 22, 2026 • updated

  HTTP/2 (h2c) DATA frames. phoenix on cowboy (h2c) Phoenix 1.8.7 / plug_cowboy 2.8.1 / cowboy 2.15.0. verdict: protected h2 goaway.

  [http][h2][beam][chunkloris][per-chunk-amplification]+1 more

• chunkloris: phoenix

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. phoenix 1.7 on plug_cowboy 2.7 / cowboy 2.15.0. verdict: vulnerable per chunk.

  [http][h1][beam][chunkloris][per-chunk-amplification]+1 more

• chunkloris: puma

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. puma 6.4.3. verdict: vulnerable per chunk.

  [http][h1][ruby][chunkloris][per-chunk-amplification]+1 more

• chunkloris: uvicorn (websockets impl)

  May 22, 2026 • updated

  WebSocket text frames. uvicorn (websockets impl) uvicorn 0.32.1, websockets 13.1, starlette 0.41.3. verdict: vulnerable per frame.

  [http][ws][python][chunkloris][per-chunk-amplification]+1 more

• chunkloris: uvicorn (wsproto impl)

  May 22, 2026 • updated

  WebSocket text frames. uvicorn (wsproto impl) uvicorn 0.32.1, wsproto 1.2.0, starlette 0.41.3. verdict: vulnerable per frame.

  [http][ws][python][chunkloris][per-chunk-amplification]+1 more

• chunkloris: hyper 1.5 + h2 0.4 (h2c)

  May 22, 2026 • updated

  HTTP/2 (h2c) DATA frames. hyper 1.5 + h2 0.4 (h2c) hyper 1.5 / h2 0.4. verdict: batches correctly.

  [http][h2][rust][chunkloris][per-chunk-amplification]+1 more

• chunkloris: tokio-tungstenite

  May 22, 2026 • updated

  WebSocket text frames. tokio-tungstenite 0.24 on rust 1.83. verdict: batches correctly.

  [http][ws][rust][chunkloris][per-chunk-amplification]+1 more

• chunkloris: Spring Boot + Tomcat

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. Spring Boot + Tomcat spring-boot-3.3.5 / tomcat-10.1. verdict: vulnerable per chunk.

  [http][h1][jvm][chunkloris][per-chunk-amplification]+1 more

• chunkloris: Spring Boot + Tomcat (h2c)

  May 22, 2026 • updated

  HTTP/2 (h2c) DATA frames. Spring Boot + Tomcat (h2c) spring-boot-3.3.5 / tomcat-10.1. verdict: protected h2 goaway.

  [http][h2][jvm][chunkloris][per-chunk-amplification]+1 more

• chunkloris: tornado

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. tornado 6.4.2. verdict: vulnerable per chunk.

  [http][h1][python][chunkloris][per-chunk-amplification]+1 more

• chunkloris: unicorn

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. unicorn 6.1.0. verdict: vulnerable per chunk.

  [http][h1][ruby][chunkloris][per-chunk-amplification]+1 more

• chunkloris: uvicorn

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. uvicorn 0.32.1. verdict: vulnerable per chunk.

  [http][h1][python][chunkloris][per-chunk-amplification]+1 more

• chunkloris: uvicorn

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. uvicorn 0.32.1. verdict: vulnerable per chunk.

  [http][h1][python][chunkloris][per-chunk-amplification]+1 more

• chunkloris: Vert.x

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. Vert.x 4.5.10. verdict: vulnerable per chunk.

  [http][h1][jvm][chunkloris][per-chunk-amplification]+1 more

• chunkloris: Vert.x 4.5 (Netty h2c)

  May 22, 2026 • updated

  HTTP/2 (h2c) DATA frames. Vert.x 4.5 (Netty h2c) 4.5.10. verdict: batches correctly.

  [http][h2][jvm][chunkloris][per-chunk-amplification]+1 more

• chunkloris: waitress

  May 22, 2026 • updated

  HTTP/1.1 chunked transfer encoding. waitress 3.0.2. verdict: vulnerable per chunk.

  [http][h1][python][chunkloris][per-chunk-amplification]+1 more