HTTP/3 Client Matrix

The implementations

Reading this honestly

• A fail is a specification violation, not a security vulnerability. Some may have security relevance; most are simply behaviour a specification prohibits. Treating every failure as a vulnerability would make the whole dataset less credible.
• Every cell here is conclusive. Each client was put in the situation every test is about, and its answer was seen: a pass, a fail, or unsupported where the client does not do the thing the test needs. The suite can still return inconclusive to anyone running it — a client that connects once cannot be asked about 0-RTT — but none of this matrix's cells carry it.
• Rejecting at the QUIC layer is not a pass either. Some clients answer an HTTP/3 violation by closing the QUIC connection rather than sending an HTTP/3 error code — H3_MISSING_SETTINGS arrives as a transport INTERNAL_ERROR. The client plainly objected, and the report says so, but the code the clause names never reached the wire. Where the clause requires a specific code, that is a fail: the test asks what the client signalled, and a transport close signals nothing an HTTP/3 peer can read.
• This paragraph used to say those cells read inconclusive. They did, until the observation was split out from the one that means “responded correctly”. Folding them together had reported “Responded correctly” about a code the server had never seen, so a client that sent an HTTP/3 code and got it slightly wrong scored worse than one that sent none at all. The wording above outlived that change by a few days and is corrected here rather than quietly replaced, because a rule page that has been wrong should say when.
• A fail is never inferred from silence. Every failure in this table rests on something the server watched the client do — a rejection carrying the wrong error code, datagrams that kept arriving after a Stateless Reset, a valid response abandoned. Absence of a rejection is consistent with a client that accepted the violation and with one that never saw it, so it is not reported as either.
• A silence only counts once the client has had its chance. Each test declares a reaction opportunity: not a stopwatch, but an event the server watched happen, after which a client that meant to object had the means to. For most tests it is the request and response completing. Where the anomaly rides a stream the client is not obliged to read promptly, it is the proof that the client read that stream. For the 0-RTT ports it is early data actually arriving and being refused in the handshake. For the tests whose anomaly is an absence — a Stateless Reset, a vanished path — it is the server still being there a set interval later, because there is no exchange to complete. A silence-based failure requires the implementation to have still been running when its opportunity arrived. One that terminated first is recorded inconclusive, because a peer that has gone and a peer that read the violation and tolerated it look identical from a socket, and only the second is a failure.
• An exit afterwards erases nothing. The rule asks whether the observation was still possible when the chance to make it came, not how long the client stayed after. A client that leaves at seven seconds of an eight-second window keeps its failure if its exchange completed at one — the evidence was already collected. Where this changed a verdict, the cell carries client_exit_before_reaction_opportunity alongside the timestamps and the evidence the verdict was derived from, so it can be audited rather than taken on trust.
• Client wrappers are deliberately thin. Each is a few lines that make one request and exit. Everything under test belongs to the library, not the wrapper; anything clever in a wrapper would be measuring the wrapper.
• One of these is ours. The quinn row runs the same forked stack that serves the suite. It is included because excluding it would be hiding a result, but it is the one row to read with the most suspicion.

Generated 2026-10-22T04:21:51Z. Run the suite against your own client at conformance.pqcrypta.com.