---
title: 'Header Accordions': one small HTTP/3 request can make seven of ten tested servers allocate up to thousands of times more memory; Bun, hyperium h3 and aioquic are still unpatched | ctxsec
url: https://ctxsec.com/items/foxio-header-accordions-qpack-http3-dos
description: ""
status: "confirmed (FoxIO research, vendor GitHub advisories, oss-security Oct 22)"
published: 2026-10-21
---

> 

[← Cybersecurity News](/news) · [markdown](/items/foxio-header-accordions-qpack-http3-dos.md)

confirmed (FoxIO research, vendor GitHub advisories, oss-security Oct 22)

2026-10-21

### 'Header Accordions': one small HTTP/3 request can make seven of ten tested servers allocate up to thousands of times more memory; Bun, hyperium h3 and aioquic are still unpatched

FoxIO researcher **Sébastien Féry** published **Header Accordions**, a set of QPACK amplification bugs in HTTP/3 implementations. Decoded-header limits were missing, incomplete or applied too late, so a single connection with a small HEADERS frame can expand into hundreds of thousands of header objects and exhaust memory on a default-configured server. It's an implementation problem, not a flaw in QUIC itself.

- **Fixed:** quic-go 0.57.0 (CVE-2025-64702; used by Caddy, Traefik and cloudflared), Cloudflare quiche 0.29.3 (CVE-2026-12523), lsquic 4.9.0 (no CVE), Wireshark 4.6.2 / 4.4.12 (CVE-2025-13945).
- **Unpatched as of FoxIO's write-up:** Bun (about 4,000x amplification), hyperium h3 (thread panic at 32,768 headers), aioquic/mitmproxy.
- **Not affected per FoxIO:** Google quiche, IIS (http.sys), Envoy, ngtcp2/nghttp3.

**Do now:** update quic-go-based proxies and quiche; don't expose Bun HTTP/3 servers; run mitmproxy with `--set http3=false`; set `max_field_section_size` in h3. See the [tip](/tips#tip-find-exposed-http3-qpack).

Sources: [FoxIO: Header Accordions, QPACK amplification attacks against HTTP/3 servers](https://foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers) · [oss-security (Oct 22)](https://www.openwall.com/lists/oss-security/2026/10/22/1) · [quic-go advisory GHSA-g754-hx8w-x2g6](https://github.com/quic-go/quic-go/security/advisories/GHSA-g754-hx8w-x2g6) · [Cloudflare quiche advisory GHSA-4fgf-9xrr-88gf](https://github.com/cloudflare/quiche/security/advisories/GHSA-4fgf-9xrr-88gf)