"Wireshark said it is 'unaware of any exploits for this issue.'" That cautionary note comes amid a wider disclosure from security firm FoxIO that a class of QPACK-related flaws can crash many HTTP/3 servers with a single connection.
How QPACK header compression is being weaponized
FoxIO’s research shows attackers can send a small batch of compressed HTTP headers that expand in memory into a vastly larger set when a server decodes them. QPACK — the header-compression scheme HTTP/3 uses so repeated fields travel as short codes instead of full text — is supposed to let servers cap the size of headers after unpacking. The vulnerable implementations either cap only the compressed bytes received on the wire or apply limits too late, allowing one request to expand into hundreds of thousands of header entries that the server holds in memory.
Measured amplification: 17× to roughly 4,000×
FoxIO published proof-of-concept code and measured amplification ratios against default server settings. In one test against quic-go, a 1 MB compressed batch unpacked into about 160,000 header fields and left roughly 15 MB held in the request — about 17 times the bytes sent; quic-go’s own advisory cites possible expansion at around 50 times. A second amplification technique stores one roughly 4 KB header entry and then points at it thousands of times using one-byte references; the server rebuilds the full entry on each reference. FoxIO measured about 4,000 times amplification on Bun and between 600 and 1,800 times on lsquic.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhich stacks and servers are affected or not
FoxIO tested ten HTTP/3 stacks and found the same class of flaw in seven. Fixes are available for quic-go, Cloudflare quiche, lsquic and Wireshark. Bun, the h3 Rust library and aioquic were still unpatched at disclosure. FoxIO lists IIS, Envoy, ngtcp2/nghttp3, and Google’s quiche as not affected; those stacks cap the unpacked headers while decoding rather than after.
The reach is broader because affected libraries sit under common software: quic-go is the Go library behind Caddy, Traefik and cloudflared; lsquic is LiteSpeed’s library, used in LiteSpeed Web Server and OpenLiteSpeed; Bun’s HTTP/3 server runs on lsquic.
Bun and lsquic: the worst-case behavior FoxIO found
Bun carries a worst-case scenario. Bun’s documentation calls its HTTP/3 server “experimental”; it uses lsquic but replaces lsquic’s cap with its own code that checks each header but never a running total. FoxIO found that once unpacked headers pass 2 GB the size counter in Bun’s code overflows to zero and the server enters a loop it never leaves. In one proof-of-concept, a single stream carrying about 516 KB on the wire left the server stuck at 100% CPU with no recovery, blocking new requests.
By contrast, lsquic’s upstream fix — released July 16, 2026 — caps how many unpacked header sets a server holds per stream, defaulting to one. FoxIO noted lsquic’s own 64 KB cap prevents the overflow scenario Bun introduced by replacing that cap.
Mitigations, fixes and interim steps
- Fixes available: quic-go, Cloudflare quiche, lsquic and Wireshark have released updates addressing the issues FoxIO disclosed.
- Unpatched at disclosure: Bun, the h3 Rust library and aioquic remained exposed; FoxIO provided interim mitigations for each.
- Vendor-specific interim steps FoxIO recommended: do not expose Bun’s HTTP/3 server; for mitmproxy, turn off HTTP/3 by passing --set http3=false; for the h3 Rust library, set a sensible limit with max_field_section_size.
- Wireshark’s flaw differs: it crashes the HTTP/3 dissector when Wireshark decrypts traffic using a key-log file or opens a capture file that holds decryption secrets; it is not reachable over the network. Wireshark said it is “unaware of any exploits for this issue.”
- FoxIO emphasized the attacks produce denial-of-service only: the flaws cause only denial-of-service attacks, with no evidence of data theft or code execution and no public reports of attacks in the wild.
What this means for Caddy, Traefik, LiteSpeed and Bun operators
Operators running servers built on quic-go (Caddy, Traefik, cloudflared) and lsquic (LiteSpeed Web Server, OpenLiteSpeed) should apply the available updates for those libraries. For Bun users, FoxIO’s guidance is categorical: do not expose an HTTP/3 server until Bun ships a fix, because Bun’s replacement of lsquic’s memory cap can lead to a 2 GB overflow and a locked CPU state. Network defenders should also note that the attacker needs no account or special access, and since HTTP/3 runs over UDP, the request can reach the server before much of usual filtering applies.
FoxIO said the lsquic fix grew from prior research: work began after Gal Bar Nahum’s research into "MadeYouReset," a denial-of-service technique against HTTP/2, which asked whether HTTP/3’s header compression had a similar weakness.
For now, the practical step is straightforward: upgrade the affected stacks where fixes exist, apply FoxIO’s interim mitigations for unpatched libraries, and treat any exposed HTTP/3 endpoint — particularly Bun’s experimental server — as high-risk until vendors ship patches.
