QPACK bugs let attackers OOM many HTTP/3 servers

Unauthenticated clients can crash or freeze many HTTP/3 servers by abusing QPACK header compression, according to research from FoxIO shared on the oss-security list. One connection is enough to exhaust memory on a default-configured server, and seven of ten implementations tested were vulnerable.

QPACK shrinks HTTP/3 headers for the wire. Across the affected stacks, limits on decoded headers were missing, incomplete, or applied too late, so a small HEADERS frame could expand into hundreds of thousands of header objects in memory. FoxIO reported that a remote client can force a server to allocate tens to thousands of times more memory than it sends, turning modest traffic into an out-of-memory or resource-pinning attack.

Several projects have already shipped fixes. quic-go 0.57.0 addresses CVE-2025-64702. Cloudflare quiche 0.29.3 addresses CVE-2026-12523. lsquic 4.9.0 is patched without a CVE. Wireshark 4.6.2 and 4.4.12 address CVE-2025-13945. As of the October 20, 2026 cutoff in the report, Bun 1.4.3, the h3 crate from hyperium, and aioquic (and thus mitmproxy) remained unpatched.

Suggested short-term steps include not exposing HTTP/3 on Bun, disabling HTTP/3 in mitmproxy, and setting a reasonable max_field_section_size for h3. IIS, Envoy, and ngtcp2/nghttp3 were not affected. Defenders need cumulative budgets enforced while fields are decoded and retained; without that, header expansion remains a practical remote denial-of-service path against HTTP/3 services.