HTTP/3 Client Matrix

The implementations

Per-test results

Rows where the implementations disagree are marked ◆. Hover a cell for what the server actually observed.

Verdict and implementation work together: choosing a verdict alone shows every test where any client scored it, and adding an implementation narrows that to one column — “every failure in Chromium”, or “every RFC 9114 correctness test where implementations disagree”. Column headings sort.

Reading this honestly

• A fail is a specification violation, not a security vulnerability. Some may have security relevance; most are simply behaviour a specification prohibits. Treating every failure as a vulnerability would make the whole dataset less credible.
• Inconclusive is not a soft fail. Most often it means the run never put that client in the situation the test is about — no session ticket to attempt 0-RTT with, a network that stripped ECN, a zero QPACK table capacity. It also covers the case where the client's answer could not be observed at all: an anomaly written to the control stream that a one-shot request closed before reading, or a rejection whose CONNECTION_CLOSE was lost on the way back. It counts neither way.
• Rejecting at the QUIC layer is not a pass either. Some clients answer an HTTP/3 violation by closing the QUIC connection rather than sending an HTTP/3 error code — H3_MISSING_SETTINGS arrives as a transport INTERNAL_ERROR. The client plainly objected, but the code the clause names never reaches the wire, so those cells read inconclusive. It is the single biggest reason a column here is full of them, and it is not a criticism: it means the one thing the test asks about could not be observed.
• A fail is never inferred from silence. Every failure in this table rests on something the server watched the client do — a rejection carrying the wrong error code, datagrams that kept arriving after a Stateless Reset, a valid response abandoned. Absence of a rejection is consistent with a client that accepted the violation and with one that never saw it, so it is not reported as either.
• Client wrappers are deliberately thin. Each is a few lines that make one request and exit. Everything under test belongs to the library, not the wrapper; anything clever in a wrapper would be measuring the wrapper.
• One of these is ours. The quinn row runs the same forked stack that serves the suite. It is included because excluding it would be hiding a result, but it is the one row to read with the most suspicion.

Generated 2026-09-17T20:03:02Z. Run the suite against your own client at conformance.pqcrypta.com.