Implementações HTTP/3 / QPACK · Public exploit code

Research details QPACK amplification attacks on HTTP/3 stacks

Oct 19, 2026 · 1 min read

FoxIO research describes amplification attacks against QPACK headers across several HTTP/3 implementations. Fixes shipped in quic-go 0.57.0, quiche 0.29.3, lsquic 4.9.0 and Wireshark 4.6.2/4.4.12. Bun and aioquic/mitmproxy remained unpatched as of the report date.

By HIFY Radar newsroom Updated 10/26/2026 01:20 PM Get this every day →← Back to the feed 2 sources

MediumVulnerabilityPublic exploit codePartial fix

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

FoxIO research details amplification attacks on QPACK headers in HTTP/3 stacks. A remote, unauthenticated client can make a server allocate tens to thousands of times more memory than it sends. A single connection is enough to OOM or pin a default-configured server.

Why it matters

Seven of the ten implementations tested are vulnerable, according to FoxIO. Internet-exposed HTTP/3 services can be taken offline with little attacker traffic. Bun 1.4.3, h3 and aioquic/mitmproxy remained unpatched as of October 20, 2026.

What to do

Update now: quic-go 0.57.0, Cloudflare quiche 0.29.3, lsquic 4.9.0 and Wireshark 4.6.2 or 4.4.12. Where no patch exists, mitigate: do not expose Bun HTTP/3 servers, disable HTTP/3 in mitmproxy (--set http3=false) and set max_field_section_size in h3. IIS, Envoy and ngtcp2/nghttp3 are not affected.

For the technical team

CVE: CVE-2025-64702, CVE-2026-12523, CVE-2025-13945
Affected: Implementações HTTP/3 / QPACK (quic-go, Cloudflare quiche, lsquic, Bun, aioquic, h3, Wireshark) · Seven of the ten HTTP/3 implementations tested by FoxIO. Fixed: quic-go, Cloudflare quiche, lsquic, Wireshark. Unpatched as of October 20, 2026: Bun 1.4.3, h3 (hyperium), aioquic/mitmproxy. Not affected: IIS, Envoy, ngtcp2/nghttp3.
Exploitation: FoxIO research with reference date October 20, 2026; summary posted to oss-security by Alan Coopersmith (Oracle) on October 21, 2026. Sources report no in-the-wild exploitation.
Fix: quic-go 0.57.0 (CVE-2025-64702); Cloudflare quiche 0.29.3 (CVE-2026-12523); lsquic 4.9.0 (no CVE); Wireshark 4.6.2 / 4.4.12 (CVE-2025-13945). Mitigations without a patch: Bun, do not expose HTTP/3 servers; mitmproxy, --set http3=false; h3, set a reasonable max_field_section_size. Full fix requires a cumulative memory budget enforced as fields are decoded and retained.
Vector: Memory amplification in the QPACK header decoder of HTTP/3 servers. Decoded-header limits missing, incomplete, or applied too late; a small HEADERS frame expands into hundreds of thousands of in-memory header objects. Remote, unauthenticated exploitation with a single connection.
More details: FoxIO states one connection is enough to OOM or pin a default-configured server. Alan Coopersmith (Oracle Solaris Engineering) posted the summary to oss-security on October 21, 2026, 17:13 -0700. Full details on the FoxIO blog.