FoxIO published full technical details and proof-of-concept code on October 20 for what it calls "Header Accordions," a class of vulnerabilities in QPACK, the header-compression scheme used by HTTP/3. The core finding: a remote, unauthenticated client can force an HTTP/3 server to allocate far more memory than it receives over the wire. In the worst case, a single connection is enough to exhaust memory or pin CPU on a server running default settings.
Sébastien Féry, the FoxIO researcher who discovered the flaws while building JA4Scan, the company's active QUIC and TLS fingerprinting tool, tested ten HTTP/3 implementations. Seven were vulnerable.
How the Attack Works
QPACK compresses HTTP/3 headers to reduce the bytes sent over the wire. It works by referencing entries in a static table of common header names and values, and optionally inserting custom entries into a dynamic table for reuse. The problem is that some implementations enforce limits only on the compressed size of HEADERS frames, not on the decoded output.
An attacker can exploit QPACK's static table by sending small index references that expand into large strings when decoded. In the lsquic implementation, FoxIO measured amplification ratios of 600 to 1,800 times. The dynamic-table variant is even more direct: an attacker inserts a 4 KiB entry once, then references it thousands of times with 1-byte indices. Each reference forces a fresh allocation and copy of the full entry.
"Preventing that expansion from exhausting resources requires enforcing a cumulative budget as fields are decoded and retained," FoxIO wrote in its disclosure.
What's Patched, What's Not
Four libraries have shipped fixes:
- quic-go: version 0.57.0 (CVE-2025-64702)
- Cloudflare quiche: version 0.29.3 (CVE-2026-12523)
- lsquic: version 4.9.0 (no CVE assigned)
- Wireshark: versions 4.6.2 and 4.4.12 (CVE-2025-13945)
Three remain unpatched as of the disclosure date:
- Bun 1.4.3: FoxIO advises against exposing Bun's HTTP/3 server to the public internet. A second bug in Bun can also leave the server stuck at 100% CPU permanently.
- h3 (hyperium): operators should set a reasonable
max_field_section_sizevalue. - aioquic / mitmproxy: users can disable HTTP/3 by passing
--set http3=false.
IIS, Envoy, and ngtcp2/nghttp3 were not affected.
Context
This is not FoxIO's first QPACK disclosure. In July, Féry reported XRING, an unpatched flaw in Alibaba's XQUIC library that crashes servers with roughly 260 bytes of spec-compliant traffic. That bug was a different vulnerability class but hit the same attack surface: the QPACK encoder stream.
HTTP/3 adoption has accelerated in the past two years, and with it, the security surface area. A separate HAProxy vulnerability disclosed in April showed how a single zero-byte QUIC packet could desynchronize backend connection pools. The NGINX HTTP/3 module has seen two critical flaws this year alone, including CVE-2026-42530, a use-after-free that a remote attacker can reach through the same QPACK encoder stream.
John Althouse, FoxIO's founder and the inventor of the widely used JA3 and JA4+ fingerprinting methods, announced the disclosure on X with some self-deprecation: "Sorry everyone... We're announcing a 0-Day vuln in QUIC that allows anyone to remotely turn off a server running these libraries. I swear we didn't plan this."
What Operators Should Do
The CVE-2026-12523 advisory for Cloudflare quiche rates the vulnerability 7.5 (High) on the CVSS 3.1 scale. CVE-2025-64702 for quic-go is rated 5.3 (Medium). The variance reflects differences in amplification factor and default configurations, but the practical outcome is the same: an attacker can knock a server offline without authentication.
Operators running the patched libraries should update immediately. Those running Bun, h3, or aioquic should apply the mitigations FoxIO recommends or disable HTTP/3 until patches ship. FoxIO has not disclosed a timeline for when patches might arrive for the remaining libraries.
