Overview
Security firm FoxIO disclosed on October 20, 2026 a class of flaws in QPACK, the header-compression scheme used by HTTP/3. A remote, unauthenticated attacker can crash many HTTP/3 servers with a single connection by sending a small batch of compressed headers that expands to a far larger set in memory. FoxIO published working proof-of-concept code and calls the technique a "header accordion."
Seven of the ten HTTP/3 stacks FoxIO tested were affected. The impact is denial of service only. There is no evidence of data theft or code execution, and no attacks in the wild have been reported.
How It Works
The affected stacks limit the size of the compressed batch received on the wire, but not the size of the unpacked result, or they apply the limit too late. An attacker stores one large header entry (about 4 KB) in the QPACK dynamic table, then references it thousands of times using one-byte references. The server rebuilds the full entry on every reference.
| Stack | Observed effect |
|---|---|
| Bun (experimental HTTP/3, uses lsquic) | About 4,000× amplification; a size counter overflows to zero past 2 GB of unpacked headers and the server loops forever |
| lsquic | 600× to 1,800× amplification |
| quic-go | A 1 MB batch becomes about 160,000 header fields and roughly 15 MB held in memory (about 17×); the project's advisory cites around 50× |
Patch Status
| Status | Implementations |
|---|---|
| Fixed | quic-go, Cloudflare quiche, lsquic, Wireshark (4.6.2 and 4.4.12, CVE-2025-13945) |
| Unpatched at disclosure | Bun, the h3 Rust library, aioquic |
| Not affected | IIS, Envoy, ngtcp2/nghttp3, Google's quiche (each caps unpacked headers during decoding) |
Recommended Actions
- Update any HTTP/3 library or server built on quic-go, quiche or lsquic to the fixed release
- Bun: do not expose an HTTP/3 server until a fix ships
- mitmproxy: disable HTTP/3 with
--set http3=false - h3 Rust library: set a sensible
max_field_section_size - Inventory which services terminate HTTP/3 (CDNs, reverse proxies, application servers) and whether they sit behind a front end that is not affected
- Monitor for sudden per-connection memory growth and out-of-memory restarts on QUIC listeners
References
- The Hacker News — New QPACK Flaws Can Crash HTTP/3 Servers
- FoxIO — "Header Accordions: QPACK amplification attacks against HTTP/3 servers"