Security1 hOctober 25, 2026, 10:22

FoxIO details QPACK amplification attack on HTTP/3 servers

FoxIO published full details and proof-of-concept code for Header Accordions, a QPACK amplification attack that makes HTTP/3 servers allocate thousands of times more memory than a client sends. Seven of ten tested implementations were vulnerable, and three remain unpatched: Bun 1.4.3, the h3 crate and aioquic with mitmproxy.

DEV Community

Open source

FoxIO details QPACK amplification attack on HTTP/3 servers

Amplification reached roughly 4,000 to 1; lsquic saw 600–1,800x
Fixes shipped in quic-go 0.57.0, quiche 0.29.3, lsquic 4.9.0 and Wireshark
Bun, h3 and aioquic/mitmproxy were still unpatched as of 20 October 2026
IIS, Envoy, Google quiche and ngtcp2 enforced limits correctly

#FoxIO#Quic-go#Quiche#Wireshark

QPACK flaws can crash HTTP/3 servers with 4,000-fold memory amplification

Security

Researcher reproduces QPACK amplification in aioquic: 54 KB expands to 200 MB

Security

Wireshark 4.6.9 fixes 19 security vulnerabilities, including possible code execution

Security

FoxIO details QPACK amplification attack on HTTP/3 servers

QPACK flaws can crash HTTP/3 servers with 4,000-fold memory amplification

Researcher reproduces QPACK amplification in aioquic: 54 KB expands to 200 MB

Wireshark 4.6.9 fixes 19 security vulnerabilities, including possible code execution

October 21 security roundup: PHP2Shell, Java, HTTP/3, Node.js, Railway and OVH