New QUIC 0-day lets one connection OOM HTTP/3 servers; 7 of 10 libraries vulnerable
cephaloform · x · 2026-10-22
FoxIO researchers disclosed a new class of QPACK amplification attacks against HTTP/3 servers, dubbed Header Accordions: a remote, unauthenticated client can force a server to allocate tens to thousands of times more memory than the request occupies on the wire, with a single connection enough to OOM or pin a default-configured server.
- Root cause: decoded-header limits that are missing, incomplete, or applied too late, letting a small HEADERS frame expand into hundreds of thousands of header objects.
- 7 of 10 tested implementations were vulnerable.
- Patched: quic-go 0.57.0, Cloudflare quiche 0.29.3, lsquic 4.9.0, Wireshark 4.6.2/4.4.12.
- Still unpatched: Bun 1.4.3, h3 (hyperium), aioquic/mitmproxy — mitigations include disabling HTTP/3 or setting maxfieldsectionsize.
- Not affected: IIS, Envoy, ngtcp2/nghttp3.
More from Safety
- Anthropic's assessment claims 'technical problems of AI safety are solved,' drawing backlash — TheZvi · 2026-10-22
- Wikipedia goes down over two PHP flaws as OpenAI and humans spar over who found them — bindureddy · 2026-10-22
- moyix: by the time you import the malicious package, arbitrary code has already run — moyix · 2026-10-22
- repligate Challenges the Orthogonality Thesis: Smart Systems Can't Have Arbitrary Traits in the Real World — repligate · 2026-10-22
- Security researchers warn simultaneous PHP/GitLab vulns make next 8 months 'continuous hell' — joshua_saxe · 2026-10-22
- Can defenders use the same LLM to find and patch an undisclosed PHP exploit first? — ccerrato147 · 2026-10-22