// tag
Go libraries and tools. Newest first.
› HTTP/3 / QPACK stacks (quic-go, Cloudflare quiche, lsquic, Bun, aioquic, h3, Wireshark, …)
FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.
HTTP/3 servers using QPACK are exposed to serious memory-amplification flaws. Attackers can crash servers with tiny compressed headers. Key stacks like quic-go, quiche, lsquic patched—but Bun, h3, aioquic still vulnerable. Mitigations needed now. #HTTP3 #QPACK #Vulnerability t.co/ZU7h7ky0XX
HTTP/3サーバ向けのDoS攻撃手法、QPACK増幅攻撃"Header Accordions"のPoC（攻撃の概念実証コード）と詳細が開示された。quic-go、Cloudflare quiche、Wiresharkは修正済み。Microsoft IIS、Envoy、Google quiche、ngtcp2/nghttp3は元々脆弱ではない。 t.co/iIRxIHmhnu
QUICの多くの実装でのOOM "Header Accordions: QPACK amplification attacks against HTTP/3 servers - FoxIO | Cyber Innovation" t.co/qEjI9cftas
