QPACK flaws let one HTTP/3 connection exhaust server memory
Original title: Header Accordions: QPACK amplification attacks against HTTP/3 servers
Seven of ten tested stacks were vulnerable; quic-go, quiche, lsquic and Wireshark had fixes as of October 20, 2026.
A remote, unauthenticated client can make an HTTP/3 server allocate tens to thousands of times more memory than the request sends, enough to exhaust memory or pin a default-configured server. Missing or late decoded-header limits let a small QPACK HEADERS frame expand into huge numbers of header objects. Seven of ten implementations tested were vulnerable. quic-go, Cloudflare quiche, lsquic and Wireshark were patched as of October 20, 2026; Bun, h3 and aioquic/mitmproxy were not.
- quic-go 0.57.0 fixes CVE-2025-64702; amplification was about 15 times.
- Cloudflare quiche 0.29.3 fixes CVE-2026-12523, about 20 times.
- lsquic 4.9.0 is fixed with no CVE, at roughly 600 to 1,800 times.
- Wireshark 4.6.2 and 4.4.12 fix CVE-2025-13945.
- IIS, Envoy and ngtcp2/nghttp3 were not affected.
Impact: Unauthenticated remote memory exhaustion of HTTP/3 servers
| Product | Affected | Fixed in |
|---|---|---|
| quic-go | — | 0.57.0 |
| Cloudflare quiche | — | 0.29.3 |
| LiteSpeed lsquic | — | 4.9.0 |
| Wireshark | — | 4.6.2 / 4.4.12 |
| Oven Bun | 1.4.3 | — |
| hyperium h3 | — | — |
| aioquic | — | — |
| mitmproxy | — | — |
- 1.Upgrade quic-go to 0.57.0, quiche to 0.29.3, lsquic to 4.9.0, and Wireshark to 4.6.2 or 4.4.12.
- 2.Do not expose Bun HTTP/3 servers; disable mitmproxy HTTP/3 with --set http3=false.
- 3.Set a reasonable max_field_section_size on the h3 crate.
- Vendors
- CloudflareWireshark
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-13945 | HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows denial of service | 5.5 | <1% | PoC ×2 | |
| CVE-2025-64702 | quic-go is an implementation of the QUIC protocol in Go | 5.3 | <1% | PoC | |
| CVE-2026-12523 | Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames | 7.5 | <1% |
From the original article
9 min read at foxio.io
A remote, unauthenticated client can force an HTTP/3 server to allocate tens to thousands of times more memory than it sends. One connection is enough to OOM or pin a default-configured server. Seven of the ten implementations tested are vulnerable; several are already fixed.
By foxio.io via typesanitizer · foxio.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.