L3 · ShartedHTTP/3 · DoS · QPACKqpack-header-accordions

HTTP/3: compressed headers, overflowing pipes

Header Accordions research exposes HTTP/3 QPACK denial-of-service paths across multiple stacks

FoxIO published cross-stack QPACK research and reproductions on October 20. Missing or late decoded-header limits can exhaust memory or hang servers. Several components were patched earlier; Bun, hyperium h3 and aioquic/mitmproxy had unresolved paths at disclosure.

Disclosed: Oct 20, 2026; Public disclosure date
Severity: CVSS 7.5 × 1; 3 CVEs tracked here
Splash zone: Applications exposing affected HTTP/3 stacks; Wireshark also has a separate capture-dissection issue; quic-go · quiche · bun · rust · python
In the wild: Not seen; Public reproduction code; no confirmed in-the-wild attacks in the cited reports

What happened

This entry tracks the newly published cross-stack study, not a claim that every listed CVE was disclosed this week. Old version numbers remain relevant when applications bundle an outdated library. Public reproductions and mainstream dependencies justify L3; the cited material does not establish active attacks.

What’s in the bowl

CVE-2025-64702CVSS 5.3

quic-go decoded-header memory exhaustion

Decoded headers exceed the compressed-size budget on clients and servers.

CVE-2026-12523CVSS 7.5

Cloudflare quiche resource exhaustion

HTTP/3 frame allocation and QPACK accounting permit excessive memory use.

CVE-2025-13945

Wireshark HTTP/3 dissector crash

Decrypting HTTP/3 traffic or loading captures with decryption secrets can crash the dissector.

Fixed versions

Product	Safe from	Note
quic-go	`0.57.0`
Cloudflare quiche	`0.29.3`
lsquic	`4.9.0`
Wireshark	`4.6.2 / 4.4.12`
Bun / hyperium h3 / aioquic	No fix	No fix documented by FoxIO at October 20 disclosure

Crime-scene timeline

2025–2026
Individual component advisories and fixes published
Oct 20, 2026
FoxIO publishes the cross-stack study and reproduction code

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

FoxIO original researchPrimaryOctober 20 cross-stack disclosure, reproduction code, unresolved stacks and mitigations
quic-go advisoryPrimaryCVE-2025-64702, CVSS 5.3; fixed in 0.57.0
Cloudflare quiche advisoryPrimaryCVE-2026-12523, CVSS 7.5; earliest fixed version 0.29.3
lsquic official releasesPrimary4.9.0 limits buffered header sets to cap memory use
Wireshark advisoryPrimaryCVE-2025-13945; fixed in 4.6.2 and 4.4.12; no known exploits