FoxIO

Mentions · 7d2
Mentions · 30d2
All mentions2
First seenOct 22, 2026
Last mentioned3d ago

Timeline

2 articles · newest first

QPACK flaws can crash HTTP/3 servers via memory amplification

FoxIO released PoCs; quic-go, quiche, lsquic, and Wireshark are patched, while Bun, h3, and aioquic were not.

The Hacker Newsupdated Oct 22, 15:15 UTC · 3d agofirst Oct 22, 06:38 UTC · 3d agoVulnerability 3 sourcesCVE-2025-64702 CVE-2026-12523 CVE-2025-139451 · 1 read

FoxIO describes QPACK amplification attacks against HTTP/3 servers

The October 21 oss-security note only links a FoxIO blog and says the write-up has more detail.

oss-securityupdated Oct 22, 15:15 UTC · 3d agofirst Oct 22, 00:16 UTC · 3d agoResearch 3 sources

Related CVEs

by mentions

CVE-2026-12523<1%7.5
Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames
published Jul 14, 2026cloudflare quiche
CVE-2025-13945<1%5.5
HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows denial of service
published Dec 3, 2025wireshark wiresharkPoC ×2
CVE-2025-64702<1%5.3
quic-go is an implementation of the QUIC protocol in Go
published Dec 11, 2025quic-go project quic-goPoC

Appears with

LiteSpeedvendor · 1
Wiresharkvendor · 1
h3product · 1
aioquicproduct · 1
quic-goproduct · 1
lsquicproduct · 1
Cloudflarevendor · 1
quicheproduct · 1
Bunproduct · 1

Entities are extracted by the model from each article. First seen Oct 22, 2026, last mentioned 3d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.