QPACK flaws let one connection exhaust memory on HTTP/3 servers

QPACK flaws let one connection exhaust memory on HTTP/3 servers

20 October 2026: Researchers at FoxIO have shown that a remote client with no credentials can make seven of ten HTTP/3 implementations allocate between 15 and about 4,000 times more memory than it sends, by abusing QPACK header compression, so that a single connection can exhaust or pin a server running default settings. quic-go, Cloudflare quiche, lsquic and Wireshark have fixes; Bun, the hyperium h3 crate and aioquic, which mitmproxy uses, had none when the research was published on 20 October, and proof-of-concept code is public.

Not yet independently verified. The fix status for Bun, the h3 crate and aioquic is as FoxIO reported it on 20 October; none of those projects has published an advisory we could read, and no exploitation has been reported. We will update this when it can be confirmed, and remove this note.

Versions to run

Implementation	Status on 20 October	Fixed version	Identifier
quic-go	fixed	0.57.0	CVE-2025-64702
Cloudflare quiche	fixed	0.29.3	CVE-2026-12523
lsquic	fixed	4.9.0	no CVE
Wireshark	fixed	4.6.2 or 4.4.12	CVE-2025-13945
Bun 1.4.3	not fixed	none	none
h3 (hyperium)	not fixed	none	none
aioquic and mitmproxy	not fixed	none	none

Google's quiche, Microsoft IIS (http.sys), Envoy and ngtcp2 with nghttp3 were not affected. The fixed releases are not new: quic-go 0.57.0 shipped on 21 November 2025 and quiche 0.29.3 on 14 July 2026, according to FoxIO's disclosure timeline. The risk now sits with anyone who has not updated since, and with products that pin an older build.

How a small request becomes a large allocation

QPACK lets an HTTP/3 client send a header as a short index into a table rather than as the full text. The protocol tells servers to limit the decoded size of a header list, counting the name, the value and 32 bytes of overhead per field. FoxIO's Sébastien Féry found implementations that checked only the compressed frame, decompressed everything before checking, left out the 32-byte overhead, treated an unset limit as unlimited, or never enforced the limit at all.

Two variants follow. One fills a 1,000,000-byte HEADERS frame with about 160,000 unique short header names; in quic-go that request kept roughly 15 MiB alive after garbage collection, about 15 times its size on the wire. The other inserts one entry of about 4 KiB into the dynamic table and then references it with one-byte indexes, so each byte becomes a fresh 4 KiB copy. That ratio, 4,064 to one, is how the lsquic and Bun attacks work. In the h3 crate the header map panics at 32,768 entries, killing the thread.

Where these stacks hide

Most teams do not choose a QUIC library directly; they inherit one. FoxIO notes that quic-go sits behind Caddy, Traefik and cloudflared, so a gateway, reverse proxy or tunnel built before late November 2025 may carry the vulnerable code even if nobody on the team has heard of quic-go. OpenLiteSpeed embeds lsquic, and Bun's HTTP/3 server is built on lsquic with its own header callbacks that drop lsquic's cumulative cap.

For the unfixed projects FoxIO gives stopgaps: do not expose Bun's HTTP/3 server, start mitmproxy with --set http3=false, and set a reasonable max_field_section_size on the h3 crate. Where HTTP/3 is offered at the edge, falling back to HTTP/2 until the stack is updated removes the attack path; abnormal memory growth tied to a few QUIC connections is the sign to look for.

Related on TrustList:

• LiteLLM 1.107.0 shipped a credential stealer on PyPI and Docker
• SAP patches a CVSS 10 token flaw in its Cloud SDK for Python

Sources

• FoxIO: Header Accordions, QPACK amplification attacks against HTTP/3 servers, 20 October 2026
• CVE-2025-64702: quic-go HTTP/3 QPACK Header Expansion DoS (CVE record), 11 December 2025
• CVE-2026-12523: Resource exhaustion in quiche HTTP/3 and QPACK layers (CVE record), 14 July 2026
• CVE-2025-13945: Improperly Controlled Sequential Memory Allocation in Wireshark (CVE record), 3 December 2025