PoC and Full Details Released for QPACK Amplification Attack That Crashes HTTP/3 Servers

TL;DR

On October 20, 2026, FoxIO published full details and proof-of-concept code for “Header Accordions,” a QPACK amplification attack against HTTP/3 servers. A remote, unauthenticated client can make a server allocate tens to thousands of times more memory than it sends. Seven of ten tested implementations were vulnerable, and three remain unpatched.

CVE	CVSS (CVSSv3)	Type	Fixed in	Status
CVE-2026-12523	7.5	CWE-400	0.29.3	Not exploited
CVE-2025-13945	5.5	CWE-1325	4.6.1	Not exploited
CVE-2025-64702	5.3	CWE-770	—	Not exploited

Why It Matters

HTTP/3 now carries a growing share of web traffic, and libraries like quic-go sit behind popular tools such as Caddy, Traefik and cloudflared. FoxIO warns that “one connection is enough to OOM or pin a default-configured server.” In plain terms, a single attacker can exhaust a server’s memory or freeze its CPU.

The research also shows how small inputs can cause outsized damage. In the worst case, Bun, FoxIO measured an amplification ratio of about 4,000 to 1.

Details and exploit code are now public

FoxIO published a full Header Accordions write-up with per-library analysis. In addition, the team released reproduction code for the QPACK amplification attack on GitHub. As a result, anyone can now test servers, and attackers can study the same techniques.

The bug surfaced while FoxIO built QUIC support for its active scanner. As the report explains, it was found “during recent research into the different QUIC stacks for our active TLS scanner, JA4Scan.”

A pattern seen before

Header Accordions follows a familiar playbook. FoxIO says the work was inspired by MadeYouReset, a 2025 HTTP/2 attack that also abused a protocol feature to drain server resources. In both cases, the protocol itself is sound. Instead, the danger lies in how each library applies its safety limits.

That matters for defenders. A server can look patched and well configured, yet still trust a limit that its code never checks. Therefore, teams should confirm the actual library version behind every HTTP/3 endpoint, not just the front-end product name.

How the Attack Works

HTTP/3 compresses headers with QPACK. Common fields shrink to a tiny index, and repeated fields can point to a shared table. That saves bandwidth, but it also means a small frame can describe a huge set of headers.

RFC 9114 tells servers to limit headers by their decoded size, plus 32 bytes of overhead per field. However, FoxIO found implementations that got this wrong in several ways. Some checked only the compressed size. Others decompressed everything before checking, skipped the 32-byte overhead, or never enforced the limit at all.

The research describes two broad variants. One packs a frame with huge numbers of tiny, unique headers. The other inserts one large table entry and then references it over and over, so each tiny reference forces a full copy in memory.

In FoxIO’s words, “a small HEADERS frame can therefore expand into hundreds of thousands of header objects in memory.”

How each library failed

• quic-go (CVE-2025-64702): it capped the compressed frame but not the decoded output, retaining about 15 times the encoded size.
• Cloudflare quiche (CVE-2026-12523): it omitted the 32-byte overhead and pre-allocated buffers for frames that never arrived.
• lsquic: FoxIO calls it “the deepest I found,” with amplification of roughly 600 to 1,800 times.
• Bun: it removed lsquic’s built-in cap. A second bug can also leave the server stuck at 100% CPU permanently.
• aioquic and mitmproxy: the limit is “parsed but never enforced.”
• h3 (hyperium): an oversized header set can crash a worker thread with a panic.
• Wireshark (CVE-2025-13945): the HTTP/3 dissector could freeze and crash.

Who owns the limit?

FoxIO argues the deeper problem is unclear responsibility. QUIC counts bytes, the QPACK decoder rebuilds fields, and the application stores them. “The question is simple: which component actually rejects the oversized headers?” the report asks. As a result, “an advertised limit can look reassuring while providing no protection.”

Exploitation status

Public proof-of-concept code is available. However, no source reports use of this QPACK amplification attack in the wild. None of the three CVEs appears in CISA’s Known Exploited Vulnerabilities catalog. Still, a working PoC lowers the bar for attackers, so the risk window is open now.

Affected and Fixed Versions

Patched as of October 20, 2026

• quic-go: 0.57.0
• Cloudflare quiche: 0.29.3
• lsquic: 4.9.0 (no CVE)
• Wireshark: 4.6.2 and 4.4.12

Still unpatched

• Bun 1.4.3
• h3 (hyperium)
• aioquic and mitmproxy

Not affected

Microsoft IIS, Envoy, Google quiche and ngtcp2/nghttp3 enforced limits correctly in FoxIO’s tests.

Patch and Mitigation Steps

• Upgrade quic-go, quiche, lsquic and Wireshark to the fixed versions.
• For Bun, do not expose HTTP/3 servers until a fix ships.
• For mitmproxy, disable HTTP/3 with the http3=false option.
• For the h3 crate, set a reasonable max_field_section_size.
• Find exposed servers with the JA4Scan-QUIC fingerprints FoxIO published.

To spot affected servers, FoxIO points to its JA4Scan active fingerprinting tool for TLS and QUIC. With the PoC now public, teams running HTTP/3 should treat this QPACK amplification attack as an urgent denial-of-service risk.