Your HTTP/3 endpoint is only as patched as the QUIC library behind it
Your HTTP/3 endpoint is only as patched as the QUIC library behind it On 20 October 2026, FoxIO published full details and proof-of-concept code for "Header Accordions", a QPACK amplification attack against HTTP/3 servers. A remote, unauthenticated client can make a server allocate tens to thousands of times more memory than it sends. Seven of ten implementations tested were vulnerable. Three…
The HTTP/3 endpoint's security relies heavily on the QUIC library it utilizes. On October 20, 2026, FoxIO disclosed the details and proof-of-concept code for a Header Accordions attack against HTTP/3 servers. This QPACK amplification attack allows a remote, unauthenticated client to force a server to allocate significantly more memory than it sends.
Out of ten tested implementations, seven were vulnerable, with three remaining unpatched. The issue stems from implementations handling the QUIC library's header limit requirements differently. Some checked only the compressed size, while others decompressed everything before checking, skipped the 32-byte overhead, or didn't enforce a limit at all.
Two variations involve filling a frame with many tiny, unique headers or inserting one large table entry and referencing it repeatedly, leading to hundreds of thousands of header objects in memory. The report highlights that each library's failure is mapped to a specific code defect. For instance, quic-go caps the compressed frame but not the decoded output, retaining about 15 times the encoded size.
Cloudflare quiche omits the 32-byte overhead and pre-allocates buffers for frames that never arrive. The lsquic implementation can amplify the attack by roughly 600 to 1,800 times, considered the deepest case found. Bun removes lsquic's built-in cap, aioquic and mitmproxy parse the limit but never enforce it. The h3 crate for hyperium can crash a worker thread with a panic when faced with an oversized header set.
Wireshark's HTTP/3 dissector can freeze and crash, with a secondary bug causing the server to remain at 100% CPU permanently. FoxIO's central argument lies in ownership rather than code. The report emphasizes that the component enforcing the limit is crucial. A configured maximum header size in documentation, TLS scanner profiles, and configuration files may provide a false sense of security if the code path receiving the frame doesn't consult this limit.
The report concludes with recommendations for handling HTTP/3 services, such as identifying the library used (not the product), not exposing affected stacks until a fix is released, disabling HTTP/3 for vulnerable stacks like mitmproxy, and setting a reasonable max_field_section_size.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
