FoxIO 'Header Accordions' (20 Oct): QPACK header-decoding flaws let one unauthenticated connection exhaust memory or hang HTTP/3 servers in seven of the ten implementations FoxIO tested — fixed in quic-go 0.57.0, Cloudflare quiche 0.29.3 and lsquic 4.9.0; Bun, hyperium h3 and aioquic unpatched as of 20 Oct
Security firm FoxIO published research on 20 October 2026 ('Header Accordions') showing that a remote, unauthenticated client can force an HTTP/3 server to allocate tens to thousands of times more memory than it sends, and FoxIO says one connection is enough to run a default-configured server out of memory or pin it. FoxIO says seven of the ten HTTP/3 implementations it tested are vulnerable because limits on decoded QPACK (HTTP/3 header compression) headers are missing, incomplete or applied too late, so a small HEADERS frame can expand into hundreds of thousands of header objects in memory. In FoxIO's tests a 1,000,000-byte QPACK block decoded into about 160,000 fields and kept roughly 15 MiB in a quic-go request (about 15 times the encoded size); FoxIO measured about 600–1,800 times amplification on lsquic and about 4,000 times on Bun, and says a separate Bun bug lets a single stream of about 516 KiB leave the server at 100% CPU with no recovery. FoxIO says quic-go is the Go library behind Caddy, Traefik and cloudflared. Per FoxIO, fixes are out in quic-go 0.57.0 (CVE-2025-64702), Cloudflare quiche 0.29.3 (CVE-2026-12523), lsquic 4.9.0 (no CVE) and Wireshark 4.6.2 / 4.4.12 (CVE-2025-13945, a crash in its HTTP/3 dissector rather than a server flaw), while Bun 1.4.3, the hyperium h3 Rust library and aioquic / mitmproxy were unpatched as of 20 October; FoxIO lists Google quiche, IIS and ngtcp2/nghttp3 as not vulnerable. FoxIO has published reproduction code. The flaws cause denial of service only, with no public reports of attacks in the wild, according to The Hacker News (22 Oct).
- Product
- HTTP/3 (QPACK) implementations: quic-go, Cloudflare quiche, lsquic, Bun, aioquic / mitmproxy, hyperium h3; Wireshark HTTP/3 dissector
- Versions
- Per FoxIO (as of 20 Oct 2026): quic-go ≤0.56.0 (fixed 0.57.0); Cloudflare quiche before 0.29.3 (fixed 0.29.3); lsquic before 4.9.0 (fixed 4.9.0, released 15 Jul 2026 per FoxIO); Wireshark (fixed 4.6.2 / 4.4.12). Unpatched as of 20 Oct: Bun 1.4.3, hyperium h3, aioquic / mitmproxy. Not vulnerable per FoxIO: Google quiche, IIS (http.sys), ngtcp2/nghttp3.
- CVSS
- Cloudflare quiche CVE-2026-12523: 7.5 High (CVSS 3.1, GitHub advisory); quic-go CVE-2025-64702: 5.3 Moderate (CVSS 3.1, GitHub advisory); lsquic fix has no CVE
- Exploited in Australia?
- unknown
- Patch to
- Upgrade to quic-go 0.57.0 or later (FoxIO names Caddy, Traefik and cloudflared as built on quic-go, so use builds that include it), Cloudflare quiche 0.29.3, lsquic 4.9.0 and Wireshark 4.6.2 / 4.4.12. Where no fix exists, FoxIO's interim steps: on Bun, do not expose an HTTP/3 server; on mitmproxy, disable HTTP/3 with --set http3=false; with the h3 crate, set a reasonable max_field_section_size.
Primary: FoxIO — Header Accordions: QPACK amplification attacks against HTTP/3 servers (20 Oct 2026) · Vendor: quic-go GHSA-g754-hx8w-x2g6 (CVE-2025-64702; patched v0.57.0); also Cloudflare quiche GHSA-4fgf-9xrr-88gf (CVE-2026-12523; patched 0.29.3) · CVE: CVE-2025-64702, CVE-2026-12523, CVE-2025-13945 · The Hacker News — New QPACK flaws can crash HTTP/3 servers, trigger up to 4,000-fold memory amplification (22 Oct 2026)