{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T12:59:41.857Z",
  "stack": {
    "id": "go",
    "label": "Go",
    "kind": "language",
    "url": "https://pwn.watch/s/go",
    "feed": "https://pwn.watch/s/go/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 1,
    "notFullyPatched": 1,
    "patched": 0
  },
  "incidents": [
    {
      "slug": "http3-qpack-header-accordions",
      "title": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS",
      "url": "https://pwn.watch/i/http3-qpack-header-accordions",
      "json": "https://pwn.watch/i/http3-qpack-header-accordions.json",
      "status": "live",
      "severity": "unknown",
      "patchStatus": "partial",
      "product": "HTTP/3 / QPACK stacks (quic-go, Cloudflare quiche, lsquic, Bun, aioquic, h3, Wireshark, …)",
      "stacks": [
        "go",
        "rust",
        "python"
      ],
      "cveIds": [
        "CVE-2025-64702",
        "CVE-2026-12523",
        "CVE-2025-13945"
      ],
      "affectedVersions": [
        "See FoxIO table; Bun 1.4.3 and aioquic/mitmproxy unpatched as of Oct 20 2026"
      ],
      "fixedVersions": [
        "quic-go 0.57.0",
        "Cloudflare quiche 0.29.3",
        "lsquic 4.9.0",
        "Wireshark 4.6.2 / 4.4.12"
      ],
      "startedAt": "2026-10-20",
      "closedAt": null,
      "updatedAt": "2026-10-22T11:19:00+02:00",
      "summary": "FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication."
    }
  ],
  "changes": [
    {
      "incident": "http3-qpack-header-accordions",
      "incidentTitle": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS",
      "severity": "unknown",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-20",
      "title": "FoxIO blog + PoC published; several stacks still unpatched.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/http3-qpack-header-accordions"
    },
    {
      "incident": "http3-qpack-header-accordions",
      "incidentTitle": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS",
      "severity": "unknown",
      "status": "live",
      "patchStatus": "partial",
      "date": "2025-11 → 2026-07",
      "title": "Responsible reports to quic-go, quiche, Bun, aioquic, lsquic, h3.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/http3-qpack-header-accordions"
    }
  ]
}