https://foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers
reports:
A remote, unauthenticated client can force an HTTP/3 server to
allocate tens to thousands of times more memory than it sends.
One connection is enough to OOM or pin a default-configured server.
Seven of the ten implementations tested are vulnerable; several are
already fixed.
QPACK compresses HTTP/3 headers to minimize traffic sent over the wire.
Across the affected implementations, decoded-header limits are missing,
incomplete, or applied too late. A small HEADERS frame can therefore
expand into hundreds of thousands of header objects in memory.
Preventing that expansion from exhausting resources requires enforcing
a cumulative budget as fields are decoded and retained.
Patched as of October 20, 2026
==============================
Library Fixed version Advisory
------- ------------- --------
quic-go 0.57.0 CVE-2025-64702
Cloudflare quiche 0.29.3 CVE-2026-12523
lsquic 4.9.0 no CVE
Wireshark 4.6.2 / 4.4.12 CVE-2025-13945
Unpatched as of October 20, 2026
================================
Library
-------
Bun 1.4.3
h3 (hyperium)
aioquic / mitmproxy
Mitigations
===========
Bun: Don't expose HTTP/3 servers
mitmproxy: disable HTTP/3 (pass --set http3=false)
h3 crate: set a reasonable max_field_section_size
Not affected: IIS, Envoy, ngtcp2/nghttp3
https://foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers
goes into much more detail after providing that summary.
--
-Alan Coopersmith- [email protected]
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
