Security firm FoxIO disclosed a class of denial-of-service flaws in how HTTP/3 servers unpack compressed request headers, and released proof-of-concept code. According to The Hacker News, a remote attacker with no login can send a small batch of compressed headers that expands in memory to thousands of times its size, enough to run a default server out of memory. FoxIO found the same class of flaw in seven of the ten HTTP/3 stacks it tested. It causes crashes and slowdowns only; the report shows no data theft or code execution, and no attacks in the wild have been reported.
The cause is in QPACK, the scheme HTTP/3 uses to compress headers. The affected stacks cap the compressed data that arrives on the wire but not the size once unpacked, or apply the cap too late. quic-go, for example, limits the encoded header frame (1 MB by default on the server) but not the decoded size; its advisory says a crafted frame can expand about 50 times. FoxIO measured a second, stronger method on other stacks: store one roughly 4 KB header entry, then reference it thousands of times with one-byte references, giving roughly 4,000 times amplification on Bun and 600 to 1,800 times on lsquic. Bun’s experimental HTTP/3 server is the worst case in FoxIO’s testing: a counter overflows once unpacked headers pass 2 GB, and a single stream of about 516 KB leaves the server stuck at 100 percent CPU. Because HTTP/3 runs over UDP, requests reach the server before much of the usual filtering applies.
The libraries sit under familiar software. quic-go is the Go library behind Caddy, Traefik and cloudflared; lsquic is LiteSpeed’s library, used in LiteSpeed Web Server and OpenLiteSpeed, and Bun’s HTTP/3 server runs on it. The Wireshark issue is a different case: it crashes the HTTP/3 dissector when Wireshark decrypts traffic with a key-log file, and is not reachable over the network.
How to check if you’re affected
Affected products are servers and tools built on the HTTP/3 stacks below. Fixed versions, as of October 22, 2026 per The Hacker News:
- quic-go: fixed in 0.57.0 (CVE-2025-64702). Check the quic-go version in your Go modules, or the version of Caddy, Traefik or cloudflared you run.
- Cloudflare quiche: fixed in 0.29.3 (CVE-2026-12523).
- lsquic: fixed in 4.9.0, no CVE. The fix, released July 16, 2026, limits how many unpacked header sets a server holds per stream.
- Wireshark: fixed in 4.6.2 and 4.4.12 (CVE-2025-13945).
- Bun, the h3 Rust library (hyperium) and aioquic/mitmproxy were unpatched at disclosure. FoxIO’s interim steps: on Bun, do not expose an HTTP/3 server; on mitmproxy, run with
--set http3=false; for the h3 library, setmax_field_section_sizeto a sensible limit. - FoxIO lists IIS, Envoy, ngtcp2/nghttp3 and Google’s quiche as not affected, because they cap the unpacked headers while decoding.
A product that bundles one of these libraries may need its own vendor update rather than a library bump; check each vendor’s release notes for the bundled version.
Sources
- FoxIO: Header Accordions: QPACK amplification attacks against HTTP/3 servers
- quic-go advisory: HTTP/3 QPACK Header Expansion Memory Exhaustion
- Cloudflare quiche advisory: Resource exhaustion in HTTP/3 and QPACK
- Wireshark: wnpa-sec-2025-07 HTTP3 dissector crash
- The Hacker News: New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification