'Header Accordions': one small HTTP/3 request can make seven of ten tested servers allocate up to thousands of times more memory; Bun, hyperium h3 and aioquic are still unpatched
FoxIO researcher Sébastien Féry published Header Accordions, a set of QPACK amplification bugs in HTTP/3 implementations. Decoded-header limits were missing, incomplete or applied too late, so a single connection with a small HEADERS frame can expand into hundreds of thousands of header objects and exhaust memory on a default-configured server. It's an implementation problem, not a flaw in QUIC itself.
- Fixed: quic-go 0.57.0 (CVE-2025-64702; used by Caddy, Traefik and cloudflared), Cloudflare quiche 0.29.3 (CVE-2026-12523), lsquic 4.9.0 (no CVE), Wireshark 4.6.2 / 4.4.12 (CVE-2025-13945).
- Unpatched as of FoxIO's write-up: Bun (about 4,000x amplification), hyperium h3 (thread panic at 32,768 headers), aioquic/mitmproxy.
- Not affected per FoxIO: Google quiche, IIS (http.sys), Envoy, ngtcp2/nghttp3.
Do now: update quic-go-based proxies and quiche; don't expose Bun HTTP/3 servers; run mitmproxy with --set http3=false; set max_field_section_size in h3. See the tip.
Sources: FoxIO: Header Accordions, QPACK amplification attacks against HTTP/3 servers · oss-security (Oct 22) · quic-go advisory GHSA-g754-hx8w-x2g6 · Cloudflare quiche advisory GHSA-4fgf-9xrr-88gf