---
title: Tip: find which of your services actually speak HTTP/3 before patching for Header Accordions, since many proxies enabled it quietly | ctxsec
url: https://ctxsec.com/items/tip-find-exposed-http3-qpack
description: ""
status: "guidance based on FoxIO research (Oct 20)"
published: 2026-10-21
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-find-exposed-http3-qpack.md)

guidance based on FoxIO research (Oct 20)

2026-10-21

### Tip: find which of your services actually speak HTTP/3 before patching for Header Accordions, since many proxies enabled it quietly

1. **Find UDP/443 listeners:** scan your external ranges for UDP 443 and check responses for an `Alt-Svc: h3` header (`curl -sI https://host | grep -i alt-svc`). Anything advertising h3 is reachable over QUIC.
2. **Map the stack:** Caddy, Traefik and cloudflared use quic-go; LiteSpeed uses lsquic; Bun has its own HTTP/3. Check versions against FoxIO's fixed list.
3. **If you can't patch yet,** turn off HTTP/3 (clients fall back to HTTP/2 over TCP) or block UDP 443 at the edge for that service.
4. **Watch memory:** alert on sudden RSS growth or OOM kills on HTTP/3-facing proxies.

Sources: [FoxIO: Header Accordions](https://foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers)