FoxIO has disclosed flaws in QPACK header decompression that can crash HTTP/3 servers. The researchers found the same class of bug in seven of the ten HTTP/3 stacks they tested and released working proof-of-concept code. A single unauthenticated connection can exhaust a server’s memory.
How QPACK Decompression Becomes a Memory Exhaustion Bug
The cause is that affected stacks cap the compressed size of headers but not the size after unpacking, or they apply the cap too late. An attacker can send a small amount of data that expands into a very large amount of memory use.
QPACK Amplification Figures for quic-go, lsquic and Bun
In one test against quic-go, the amplification was about 17 times, although the library’s own advisory cites 50 times. A repeated-reference method reaches about 4,000 times on Bun and between 600 and 1,800 times on lsquic.
The Bun HTTP/3 Server Worst Case
On Bun, a counter overflows once unpacked headers exceed 2 GB, and the server then spins at 100% CPU permanently. About 516 KB on the wire is enough to trigger it. Bun’s HTTP/3 server is documented as experimental.
Affected Libraries and Downstream Software
The affected stacks include quic-go, which is used by Caddy, Traefik and cloudflared; lsquic, used by LiteSpeed, OpenLiteSpeed and Bun; Cloudflare quiche; and Wireshark. At the time of disclosure, Bun, the h3 Rust library and aioquic were unpatched.
Wireshark’s issue is different. It crashes the HTTP/3 dissector when decrypting with key-log files, and it is not reachable over the network. Not affected are IIS, Envoy, ngtcp2/nghttp3 and Google’s quiche.
Disclosure Timing and the Unpatched Libraries
Bun, the h3 Rust library and aioquic had no fixes when FoxIO went public. Bun’s HTTP/3 server is documented as experimental, which limits how widely that particular worst case is likely to be deployed, while the h3 Rust library and aioquic have no such caveat in the disclosure.
Wireshark and the Key-Log Dissector Crash
The Wireshark finding stands apart from the server-side flaws. It crashes the HTTP/3 dissector only when the tool decrypts traffic using key-log files, and it cannot be reached over the network, so it affects analysts rather than servers exposed to the internet.
Fixes and Interim Settings for Unpatched HTTP/3 Libraries
Fixes are available for quic-go, Cloudflare quiche, lsquic and Wireshark. The lsquic fix was released on July 16, 2026, months before the public disclosure. For the unpatched libraries, the interim settings listed are to avoid exposing Bun’s HTTP/3 server, to set --set http3=false on mitmproxy, and to set max_field_section_size on the h3 Rust library.
Scope of the FoxIO QPACK Denial-of-Service Impact
The flaws allow denial of service only. They do not allow data theft or code execution, and no attacks in the wild have been reported. Many web servers using these libraries can be crashed by a single request delivered over UDP, which is the transport underneath HTTP/3.
The release of working proof-of-concept code alongside the disclosure means the technique is available to anyone with the code, while the reported absence of attacks means no exploitation is known yet. The long gap between the lsquic fix in July and the October disclosure reflects a coordinated process in which maintainers had time to prepare patches before details became public.
Why Seven of Ten Stacks Share the Flaw
Each affected stack either set no limit on the decompressed result or checked it after the memory had been used. The stacks outside the vulnerable group, IIS, Envoy, ngtcp2/nghttp3 and Google’s quiche, are not affected.
The recurrence of the flaw across independent implementations points to a shared pattern, the gap between the cap on compressed size and the size of the unpacked output, rather than a coding mistake in a single library. The same affected-product list includes Caddy, Traefik, cloudflared, LiteSpeed and OpenLiteSpeed as software that builds on the vulnerable libraries.
