# HTTP/3 QPACK amplification can exhaust servers: patched quiche and quic-go, exposed Bun and h3 FoxIO's October 20 cross-implementation research shows how insufficient decoded-header limits let unauthenticated HTTP/3 clients exhaust server memory. Some stacks were patched months earlier; Bun, h3 and aioquic still lacked fixes in the tested versions. HTTP/3 isn't automatically safe from compressed-header denial of service. Check the exact QUIC/QPACK library and version behind your proxy or app, upgrade fixed stacks and limit or disable vulnerable HTTP/3 endpoints. - Status: Active - Published: 2026-10-23T06:03:09+13:00 - Updated: 2026-10-23T06:03:09+13:00 - Categories: Web Development, Cloud & Infrastructure, Edge & CDN, Developer Tools - Tags: denial of service, HTTP/3, QUIC, security - Canonical HTML: https://beyondthe.news/dossiers/http3-qpack-header-accordions-memory-amplification-foxio-october-2026 ## What changed On October 20, 2026, FoxIO published comparative testing of ten HTTP/3/QPACK implementations. Seven had exploitable or crash-inducing resource-accounting weaknesses under the researchers' configurations. Compressed request headers can expand into much larger decoded field collections when implementations fail to enforce a cumulative uncompressed field-size budget early enough. This is a cross-stack disclosure of vulnerabilities, not seven newly discovered October CVEs: some fixes and advisories date to May-July 2026. FoxIO lists quic-go 0.57.0, Cloudflare quiche 0.29.3, lsquic 4.9.0 and Wireshark 4.6.2/4.4.12 as fixed for the described header variants. Bun 1.4.3, hyperium h3 and aioquic/mitmproxy were unpatched in the research snapshot. Bun 1.4.4 appeared October 22; its fix status must be checked against current upstream notes rather than inferred from the new version number. ## Why it matters Operators often enable HTTP/3 through a reverse proxy, framework or runtime without knowing which QUIC library performs QPACK decoding. A single unauthenticated client may cause excessive allocation or a worker crash, undermining availability even when network bandwidth limits are in place. Version-specific remediation matters: Cloudflare's quiche advisory confirms a high-severity resource exhaustion flaw fixed in 0.29.3, while quic-go has a distinct trailer-field vulnerability patched later in 0.59.1. The disclosure does not establish credential theft or remote code execution. ## Why compressed HTTP/3 headers become a memory problem QPACK reduces transmitted header size, but an implementation must account for the expanded field list while decoding, not after it has allocated memory. FoxIO found libraries that limited the wire frame, omitted per-field overhead, or accepted effectively unbounded decoded sections. The result is denial of service through disproportionate resource use, not evidence of confidentiality compromise. ## Patches are library- and variant-specific Cloudflare's quiche security advisory confirms the QPACK resource exhaustion and its 0.29.3 patch. The quic-go ecosystem also has a later trailer-field advisory requiring 0.59.1, so simply quoting the earlier 0.57.0 fix can leave a related issue unresolved. Inspect the bundled library version inside applications such as reverse proxies, developer servers and traffic inspection tools. ## What to do if the stack is still exposed Inventory publicly reachable HTTP/3 listeners and their underlying QPACK decoder versions. Upgrade to verified fixed releases, including downstream products that bundle these libraries. Where no fix is available, consider disabling HTTP/3 on the affected service, or enforcing supported decoded-header limits; check fallback HTTP/2 behavior and monitor memory/worker restarts. For mitmproxy, FoxIO documents disabling HTTP/3. Test availability and compatibility after changing transport configuration. ## Key details - FoxIO published the comparative research October 20, 2026; seven of ten tested implementations had vulnerable behavior in the evaluated versions. - Underlying weakness: QPACK compressed size and per-field limits can differ sharply from retained decoded memory; RFC 9114 accounts for a 32-byte overhead per header field. - Cloudflare quiche GHSA-4fgf-9xrr-88gf / CVE-2026-12523: fixed in 0.29.3 (July advisory). - quic-go's earlier header issue CVE-2025-64702 was fixed in 0.57.0; a separate trailer issue CVE-2026-40898 requires 0.59.1. - lsquic 4.9.0 and Wireshark 4.6.2/4.4.12 contain fixes for the described variants. - Bun 1.4.3, hyperium h3 and aioquic/mitmproxy were unpatched in FoxIO's October 20 snapshot; do not assume newer releases are fixed without release-note verification. - IIS, Envoy, Google's quiche and ngtcp2/nghttp3 were not affected by the tested scenarios according to FoxIO; that is not a universal security guarantee. ## Builder takeaways - Identify actual HTTP/3 library versions in proxies, runtimes, containers and packet-analysis tools; application version numbers alone are insufficient. - Upgrade quiche to at least 0.29.3 and quic-go to at least 0.59.1 for both header and trailer issues; confirm downstream patch integration. - Do not expose a vulnerable experimental HTTP/3 server while its decoder is unpatched; disable HTTP/3 or apply documented safe limits. - Treat 4,000x amplification as a researcher-measured scenario for a particular stack, not a universal performance figure. - Track fresh Bun, h3 and aioquic advisories and test that fallbacks preserve service availability. ## What to watch - Maintainer fixes for Bun HTTP/3, hyperium h3 and aioquic/mitmproxy. - Downstream Caddy, Traefik, cloudflared and other QUIC consumers incorporating updated dependencies. - Additional CVEs or disclosures clarifying header versus trailer QPACK variants. ## Uncertainties - No evidence in the cited research establishes widespread exploitation in the wild. - Fix status of Bun 1.4.4 and newer h3/aioquic builds requires explicit upstream verification after the October 20 research snapshot. - Actual denial-of-service impact depends on library, limits, memory, runtime and deployment architecture. ## Sources - [Header Accordions: QPACK amplification attacks against HTTP/3 servers](https://foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers) — FoxIO · primary security research · 2026-10-20T00:00:00+13:00. Cross-implementation tests, affected versions, limitations and mitigations; amplification figures are researcher-measured. - [Resource exhaustion in HTTP/3 and QPACK](https://github.com/cloudflare/quiche/security/advisories/GHSA-4fgf-9xrr-88gf) — Cloudflare quiche GitHub Security Advisory · primary maintainer advisory · 2026-07-14T00:00:00+12:00. CVE-2026-12523 and 0.29.3 fixed version. - [HTTP/3 QPACK Trailer Expansion Memory Exhaustion](https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9) — quic-go GitHub Security Advisory · primary maintainer advisory · 2026-05-31T00:00:00+12:00. Separate trailer issue CVE-2026-40898 fixed in 0.59.1. - [New QPACK flaws can crash HTTP/3 servers](https://www.scyscan.com/news/new-qpack-flaws-can-crash-http3-servers-trigger-up-to-4000-fold-memory-amplification/) — ScyScan · independent technical reporting · 2026-10-22T00:00:00+13:00. Independent synthesis; no independently reproduced benchmark claim.