https://seclists.org/oss-sec/2026/q4/303: Header Accordions: QPACK amplification attacks against HTTP/3 servers
Affected Software
Frequently Asked Questions
Which implementations were reported fixed, and at what versions?
The report lists quic-go 0.57.0, Cloudflare quiche 0.29.3, lsquic 4.9.0, and Wireshark 4.6.2 or 4.4.12 as fixed as of October 20, 2026. The listed CVEs are CVE-2025-64702 for quic-go, CVE-2026-12523 for quiche, and CVE-2025-13945 for Wireshark; lsquic has no CVE listed.
Which implementations were still unpatched in the report?
As of October 20, 2026, the report lists Bun 1.4.3, h3 (Hyperium), aioquic / mitmproxy as unpatched. The provided data does not specify fixed versions for these implementations.
Does exploitation require authentication, multiple connections, or non-default server settings?
No. The report states that a remote unauthenticated client can trigger the issue with one connection and that a default-configured server can be OOMed or pinned.
What condition must a mitigation enforce to prevent the memory amplification?
A server needs to enforce a cumulative resource budget while QPACK header fields are decoded and retained. The report says implementations are affected when decoded-header limits are missing, incomplete, or applied too late.