{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:10:46.198Z",
  "tag": {
    "id": "http3",
    "label": "HTTP/3",
    "isStack": false,
    "url": "https://pwn.watch/t/http3",
    "feed": "https://pwn.watch/t/http3/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 1,
    "notFullyPatched": 1,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "http3-qpack-header-accordions",
      "title": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS",
      "url": "https://pwn.watch/i/http3-qpack-header-accordions",
      "json": "https://pwn.watch/i/http3-qpack-header-accordions.json",
      "status": "live",
      "severity": "unknown",
      "patchStatus": "partial",
      "product": "HTTP/3 / QPACK stacks (quic-go, Cloudflare quiche, lsquic, Bun, aioquic, h3, Wireshark, …)",
      "tags": [
        "go",
        "rust",
        "python",
        "cloudflare",
        "http3"
      ],
      "cveIds": [
        "CVE-2025-64702",
        "CVE-2026-12523",
        "CVE-2025-13945"
      ],
      "affectedVersions": [
        "See FoxIO table; Bun 1.4.3 and aioquic/mitmproxy unpatched as of Oct 20 2026"
      ],
      "fixedVersions": [
        "quic-go 0.57.0",
        "Cloudflare quiche 0.29.3",
        "lsquic 4.9.0",
        "Wireshark 4.6.2 / 4.4.12"
      ],
      "startedAt": "2026-10-20",
      "closedAt": null,
      "updatedAt": "2026-10-22T11:19:00+02:00",
      "summary": "FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.",
      "xPost": null
    },
    {
      "slug": "nginx-october-2026-advisories",
      "title": "nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)",
      "url": "https://pwn.watch/i/nginx-october-2026-advisories",
      "json": "https://pwn.watch/i/nginx-october-2026-advisories.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "nginx",
      "tags": [
        "nginx",
        "http3",
        "tls"
      ],
      "cveIds": [
        "CVE-2026-15176",
        "CVE-2026-93479",
        "CVE-2026-95101",
        "CVE-2026-97629",
        "CVE-2026-97205"
      ],
      "affectedVersions": [
        "Varies per CVE; generally mainline before 1.31.7 and stable before 1.30.6"
      ],
      "fixedVersions": [
        "1.31.7+",
        "1.30.6+"
      ],
      "startedAt": "2026-10-14",
      "closedAt": "2026-10-14",
      "updatedAt": "2026-10-22T11:20:00+02:00",
      "summary": "nginx published multiple medium/major advisories fixed in 1.31.7+ and 1.30.6+, including HTTP/3 request-body injection (CVE-2026-95101), TLS session-ticket forgery (CVE-2026-97629), AIO use-after-free (CVE-2026-97205), and buffer overflows in alias/rewrite and map/regex paths. Same-day chatter bundled this with the PHP/Node/GitLab rush for anyone terminating HTTP on nginx.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "The Daily Tech Feed",
      "handle": "dailytechonx",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1889684200258764800/AEZLG4yL_bigger.jpg",
      "text": "HTTP/3 servers using QPACK are exposed to serious memory-amplification flaws. Attackers can crash servers with tiny compressed headers. Key stacks like quic-go, quiche, lsquic patched—but Bun, h3, aioquic still vulnerable. Mitigations needed now.\n\n#HTTP3 #QPACK #Vulnerability https://t.co/ZU7h7ky0XX",
      "date": "2026-10-22T07:02:21.000Z",
      "url": "https://x.com/dailytechonx/status/2113164033914175882",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVN3faQWgAIF_bP.jpg"
        }
      ],
      "incident": "http3-qpack-header-accordions"
    },
    {
      "authorName": "kokumօtօ",
      "handle": "__kokumoto",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1612504196720492544/T_-s-6OP_bigger.jpg",
      "text": "HTTP/3サーバ向けのDoS攻撃手法、QPACK増幅攻撃\"Header Accordions\"のPoC（攻撃の概念実証コード）と詳細が開示された。quic-go、Cloudflare quiche、Wiresharkは修正済み。Microsoft IIS、Envoy、Google quiche、ngtcp2/nghttp3は元々脆弱ではない。 https://t.co/iIRxIHmhnu",
      "date": "2026-10-22T03:32:49.000Z",
      "url": "https://x.com/__kokumoto/status/2113111305393750474",
      "media": [],
      "incident": "http3-qpack-header-accordions"
    },
    {
      "authorName": "azu",
      "handle": "azu_re",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1081057521719078912/OqWfdeQ6_bigger.jpg",
      "text": "QUICの多くの実装でのOOM \"Header Accordions: QPACK amplification attacks against HTTP/3 servers - FoxIO | Cyber Innovation\" https://t.co/qEjI9cftas",
      "date": "2026-10-21T23:49:44.000Z",
      "url": "https://x.com/azu_re/status/2113055165100286299",
      "media": [],
      "incident": "http3-qpack-header-accordions"
    }
  ],
  "changes": [
    {
      "incident": "nginx-october-2026-advisories",
      "incidentTitle": "nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "Security advisories and patched releases published on nginx.org.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/nginx-october-2026-advisories"
    },
    {
      "incident": "nginx-october-2026-advisories",
      "incidentTitle": "nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "nginx 1.31.8 mainline released.",
      "body": null,
      "sourceUrl": "https://nginx.org/",
      "url": "https://pwn.watch/i/nginx-october-2026-advisories"
    },
    {
      "incident": "http3-qpack-header-accordions",
      "incidentTitle": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS",
      "severity": "unknown",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-20",
      "title": "FoxIO blog + PoC published; several stacks still unpatched.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/http3-qpack-header-accordions"
    },
    {
      "incident": "nginx-october-2026-advisories",
      "incidentTitle": "nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-14",
      "title": "nginx 1.30.6 stable and 1.31.7 mainline released with fixes for CVE-2026-15176, -93479, -95101, -97629, -97205; njs 1.0.2 fixes CVE-2026-101025.",
      "body": null,
      "sourceUrl": "https://nginx.org/",
      "url": "https://pwn.watch/i/nginx-october-2026-advisories"
    },
    {
      "incident": "http3-qpack-header-accordions",
      "incidentTitle": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS",
      "severity": "unknown",
      "status": "live",
      "patchStatus": "partial",
      "date": "2025-11 → 2026-07",
      "title": "Responsible reports to quic-go, quiche, Bun, aioquic, lsquic, h3.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/http3-qpack-header-accordions"
    }
  ]
}