[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

guidance based on FoxIO research (Oct 20)

Tip: find which of your services actually speak HTTP/3 before patching for Header Accordions, since many proxies enabled it quietly

  1. Find UDP/443 listeners: scan your external ranges for UDP 443 and check responses for an Alt-Svc: h3 header (curl -sI https://host | grep -i alt-svc). Anything advertising h3 is reachable over QUIC.
  2. Map the stack: Caddy, Traefik and cloudflared use quic-go; LiteSpeed uses lsquic; Bun has its own HTTP/3. Check versions against FoxIO's fixed list.
  3. If you can't patch yet, turn off HTTP/3 (clients fall back to HTTP/2 over TCP) or block UDP 443 at the edge for that service.
  4. Watch memory: alert on sudden RSS growth or OOM kills on HTTP/3-facing proxies.

Sources: FoxIO: Header Accordions