A class of denial-of-service flaws in QPACK header compression has been disclosed for HTTP/3 stacks, with a remote attacker able to crash servers via a single connection by sending a small batch of compressed headers that expands dramatically in memory. The issue arises when servers cap the size of the compressed batch on the wire but fail to cap, or cap too late, the unpacked header set in memory.
In practice, a request can expand into hundreds of thousands of header entries, forcing the server to consume vastly more memory than the bytes received. FoxIO’s testing across several HTTP/3 stacks shows wide impact: seven of ten stacks examined exhibited the flaw, though progress is being made with fixes in several projects.
Affected stacks and patch status as of 22 October 2026 include: quic-go is fixed in 0.57.0 (CVE-2025-64702); Cloudflare quiche fixed in 0.29.3 (CVE-2026-12523); lsquic fixed in 4.9.0 (no CVE); Wireshark fixed in 4.6.2 / 4.4.12 (CVE-2025-13945). Bun remains unpatched, and h3 (hyperium) and aioquic / mitmproxy are still unpatched. FoxIO notes that Bun’s server replaces the memory cap with its own code and can overflow a running total once unpacked headers exceed 2 GB, causing a runaway CPU loop.
In Bun’s case a 516 KB wire payload could lock the server at 100% CPU, blocking new requests. For Wireshark, the issue concerns the dissector rather than a server exposure.
Operators should upgrade to fixed releases where available; for stacks with no fix, FoxIO’s interim guidance includes not exposing an HTTP/3 server on Bun, disabling HTTP/3 in mitmproxy with --set http3=false, and applying a sensible max_field_section_size in h3 to limit header memory. The fixes to lsquic and related stacks cap the number of unpacked header sets per stream, mitigating the amplification risk.