Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

QPACK flaws can crash HTTP/3 servers through header amplification

3 sources · 3 articlesFirst reported Updated ()
What's new

October 22 reports name patched versions and CVEs, per-stack amplification, and stacks still unpatched or unaffected.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

FoxIO disclosed unauthenticated QPACK header amplification that can crash HTTP/3 servers; several stacks are patched, others are not.

FoxIO disclosed QPACK “Header Accordions” flaws that let an unauthenticated client send a small compressed HTTP/3 header block that expands in memory enough to crash or exhaust a server. The Hacker News reports denial of service only, with no data theft, code execution, or attacks in the wild, and proof-of-concept code. Seven of ten stacks tested were vulnerable. Fixes exist for quic-go 0.57.0 (CVE-2025-64702), Cloudflare quiche 0.29.3 (CVE-2026-12523), lsquic 4.9.0 (no CVE), and Wireshark 4.6.2 and 4.4.12 (CVE-2025-13945). Bun, the h3 library, and aioquic remained unpatched at the October 22 disclosure; Lobsters says IIS, Envoy, and ngtcp2/nghttp3 were not affected.

Key facts
  • Seven of ten tested HTTP/3 stacks were vulnerable.
  • quic-go 0.57.0 fixes CVE-2025-64702; about 15-fold amplification.
  • quiche 0.29.3 fixes CVE-2026-12523; about 20-fold amplification.
  • lsquic 4.9.0 is fixed without a CVE; roughly 600–1,800 times.
  • Wireshark 4.6.2 and 4.4.12 fix dissector crash CVE-2025-13945.
  • Bun, h3, and aioquic were unpatched; FoxIO measured about 4,000-fold on Bun.
Analyze CVE-2025-64702 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 20, 2026quic-go, quiche, lsquic, and Wireshark were patched · Lobsters
  2. Oct 21, 2026Alan Coopersmith forwarded the FoxIO blog to oss-security · oss-security
  3. Oct 22, 2026FoxIO disclosed flaws; Bun, h3, and aioquic unpatched · The Hacker News

What each outlet adds

beyond the shared facts
  • The Hacker NewsDoS-only impact, no wild attacks, and about 4,000-fold on Bun
  • LobstersPer-stack ratios; IIS, Envoy, and ngtcp2/nghttp3 unaffected
  • oss-securityOctober 21 mailing-list pointer without technical detail
CVEs
CVE-2025-64702CVE-2026-12523CVE-2025-13945
Vendors
CloudflareLiteSpeedWireshark
Products
quic-goquichelsquicBunh3aioquicmitmproxyIISEnvoy
Organizations
FoxIO

Coverage

oldest first · one row per article · UTC
  1. · 3d ago oss-securityFirst report

    FoxIO describes QPACK amplification attacks against HTTP/3 servers

    The October 21 oss-security note only links a FoxIO blog and says the write-up has more detail.

  2. · 3d ago The Hacker News

    QPACK flaws can crash HTTP/3 servers via memory amplification

    FoxIO released PoCs; quic-go, quiche, lsquic, and Wireshark are patched, while Bun, h3, and aioquic were not.

  3. · 3d ago Lobsters · security

    QPACK flaws let one HTTP/3 connection exhaust server memory

    Seven of ten tested stacks were vulnerable; quic-go, quiche, lsquic and Wireshark had fixes as of October 20, 2026.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2025-13945
HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows denial of service
5.5<1%PoC ×2
CVE-2025-64702
quic-go is an implementation of the QUIC protocol in Go
5.3<1%PoC
CVE-2026-12523
Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames
7.5<1%