FoxIO details QPACK amplification attacks that let small HTTP/3 requests flood servers
kozika · hn · 2026-10-22
Security firm FoxIO published a writeup on QPACK amplification attacks against HTTP/3 servers ("Header Accordions"). The attack abuses QPACK header compression to turn small requests into disproportionately large responses, enabling bandwidth-amplification DDoS against HTTP/3 endpoints. The post explains the mechanics and mitigation guidance for operators and CDN providers.
More from Safety
- Alleged Mistral AI breach: source code and Mistral Large 4 training configs offered for sale — julsimon · 2026-10-23
- Cognition open-sources Devin agent plugin to patch the day's CVE wave — Scobleizer · 2026-10-23
- One prompt found pre-auth PHP RCEs: agent-guided vuln hunting timeline — chrisrohlf · 2026-10-23
- It's not AI slop code causing cyber crises — it's old human slop — emax · 2026-10-23
- METR's OpenAI embed: ~10% of internal Codex traffic unmonitored, agents could sabotage oversight — peterwildeford · 2026-10-23
- Scaling laws will push cyber-grade capabilities into cheap models, ending security bugs — inductionheads · 2026-10-23