{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:23:59.585Z",
  "tag": {
    "id": "go",
    "label": "Go",
    "isStack": true,
    "url": "https://pwn.watch/t/go",
    "feed": "https://pwn.watch/t/go/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 1,
    "notFullyPatched": 1,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "http3-qpack-header-accordions",
      "title": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS",
      "url": "https://pwn.watch/i/http3-qpack-header-accordions",
      "json": "https://pwn.watch/i/http3-qpack-header-accordions.json",
      "status": "live",
      "severity": "unknown",
      "patchStatus": "partial",
      "product": "HTTP/3 / QPACK stacks (quic-go, Cloudflare quiche, lsquic, Bun, aioquic, h3, Wireshark, …)",
      "tags": [
        "go",
        "rust",
        "python",
        "cloudflare",
        "http3"
      ],
      "cveIds": [
        "CVE-2025-64702",
        "CVE-2026-12523",
        "CVE-2025-13945"
      ],
      "affectedVersions": [
        "See FoxIO table; Bun 1.4.3 and aioquic/mitmproxy unpatched as of Oct 20 2026"
      ],
      "fixedVersions": [
        "quic-go 0.57.0",
        "Cloudflare quiche 0.29.3",
        "lsquic 4.9.0",
        "Wireshark 4.6.2 / 4.4.12"
      ],
      "startedAt": "2026-10-20",
      "closedAt": null,
      "updatedAt": "2026-10-22T11:19:00+02:00",
      "summary": "FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.",
      "xPost": null
    },
    {
      "slug": "http2-rapid-reset-ddos-cve-2023-44487",
      "title": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)",
      "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487",
      "json": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "HTTP/2 protocol implementations (servers, proxies, CDNs)",
      "tags": [
        "node",
        "go",
        "java",
        "dotnet",
        "http2",
        "ddos",
        "cloudflare",
        "google",
        "aws",
        "nginx",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-44487"
      ],
      "affectedVersions": [
        "Most HTTP/2 implementations; see each vendor's advisory"
      ],
      "fixedVersions": [
        "See vendor advisories (each HTTP/2 implementation shipped its own fix)"
      ],
      "startedAt": "2023-08-25",
      "closedAt": "2023-10-10",
      "updatedAt": "2023-10-10",
      "summary": "Attackers abused HTTP/2 stream cancellation (open a request, reset it right away, repeat) to make servers do work at enormous rates. Peaks hit 398M req/s at Google, 201M at Cloudflare and 155M at AWS. Almost every HTTP/2 server and proxy needed a fix, including Node.js, Go, Java servers, .NET/IIS and nginx.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "The Daily Tech Feed",
      "handle": "dailytechonx",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1889684200258764800/AEZLG4yL_bigger.jpg",
      "text": "HTTP/3 servers using QPACK are exposed to serious memory-amplification flaws. Attackers can crash servers with tiny compressed headers. Key stacks like quic-go, quiche, lsquic patched—but Bun, h3, aioquic still vulnerable. Mitigations needed now.\n\n#HTTP3 #QPACK #Vulnerability https://t.co/ZU7h7ky0XX",
      "date": "2026-10-22T07:02:21.000Z",
      "url": "https://x.com/dailytechonx/status/2113164033914175882",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVN3faQWgAIF_bP.jpg"
        }
      ],
      "incident": "http3-qpack-header-accordions"
    },
    {
      "authorName": "kokumօtօ",
      "handle": "__kokumoto",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1612504196720492544/T_-s-6OP_bigger.jpg",
      "text": "HTTP/3サーバ向けのDoS攻撃手法、QPACK増幅攻撃\"Header Accordions\"のPoC（攻撃の概念実証コード）と詳細が開示された。quic-go、Cloudflare quiche、Wiresharkは修正済み。Microsoft IIS、Envoy、Google quiche、ngtcp2/nghttp3は元々脆弱ではない。 https://t.co/iIRxIHmhnu",
      "date": "2026-10-22T03:32:49.000Z",
      "url": "https://x.com/__kokumoto/status/2113111305393750474",
      "media": [],
      "incident": "http3-qpack-header-accordions"
    },
    {
      "authorName": "azu",
      "handle": "azu_re",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1081057521719078912/OqWfdeQ6_bigger.jpg",
      "text": "QUICの多くの実装でのOOM \"Header Accordions: QPACK amplification attacks against HTTP/3 servers - FoxIO | Cyber Innovation\" https://t.co/qEjI9cftas",
      "date": "2026-10-21T23:49:44.000Z",
      "url": "https://x.com/azu_re/status/2113055165100286299",
      "media": [],
      "incident": "http3-qpack-header-accordions"
    }
  ],
  "changes": [
    {
      "incident": "http3-qpack-header-accordions",
      "incidentTitle": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS",
      "severity": "unknown",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-20",
      "title": "FoxIO blog + PoC published; several stacks still unpatched.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/http3-qpack-header-accordions"
    },
    {
      "incident": "http3-qpack-header-accordions",
      "incidentTitle": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS",
      "severity": "unknown",
      "status": "live",
      "patchStatus": "partial",
      "date": "2025-11 → 2026-07",
      "title": "Responsible reports to quic-go, quiche, Bun, aioquic, lsquic, h3.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/http3-qpack-header-accordions"
    },
    {
      "incident": "http2-rapid-reset-ddos-cve-2023-44487",
      "incidentTitle": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-10",
      "title": "Coordinated disclosure by Google, Cloudflare and AWS; CISA adds CVE-2023-44487 to KEV",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack",
      "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487"
    },
    {
      "incident": "http2-rapid-reset-ddos-cve-2023-44487",
      "incidentTitle": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-08-25",
      "title": "Cloudflare starts seeing unusually large HTTP/2 attacks",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/",
      "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487"
    }
  ]
}