HTTP/3 QPACK “Header Accordions” memory-amplification DoS

## summary

FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.

severity: DoS / OOM (library-specific CVEs; Bun amplification ~4000×)

## cve ids[3]

## timeline[2]

1. Oct 20, 2026

   FoxIO blog + PoC published; several stacks still unpatched.

2. 2025-11 → 2026-07

   Responsible reports to quic-go, quiche, Bun, aioquic, lsquic, h3.

## news & write-ups[2]

• ↗Header Accordions: QPACK amplification attacksFoxIO · Oct 20, 2026 · write-up
• ↗oss-security announcementoss-security · Oct 22, 2026

## posts[3]

K

kokumօtօ

@__kokumoto

HTTP/3サーバ向けのDoS攻撃手法、QPACK増幅攻撃"Header Accordions"のPoC（攻撃の概念実証コード）と詳細が開示された。quic-go、Cloudflare quiche、Wiresharkは修正済み。Microsoft IIS、Envoy、Google quiche、ngtcp2/nghttp3は元々脆弱ではない。 t.co/iIRxIHmhnu

TD

The Daily Tech Feed

@dailytechonx

HTTP/3 servers using QPACK are exposed to serious memory-amplification flaws. Attackers can crash servers with tiny compressed headers. Key stacks like quic-go, quiche, lsquic patched—but Bun, h3, aioquic still vulnerable. Mitigations needed now. #HTTP3 #QPACK #Vulnerability t.co/ZU7h7ky0XX

A

azu

@azu_re

QUICの多くの実装でのOOM "Header Accordions: QPACK amplification attacks against HTTP/3 servers - FoxIO | Cyber Innovation" t.co/qEjI9cftas