Header Accordions: QPACK amplification attacks against HTTP/3 servers foxio.io

FoxIO researcher Matt Holt reports that QPACK header decompression flaws let unauthenticated clients make some HTTP/3 servers use far more memory than the traffic they send, potentially causing crashes or hangs. Seven of 10 implementations tested were affected, including quic-go, quiche, lsquic, Bun, aioquic and the h3 crate; several have since been patched, while operators are advised to disable HTTP/3 or set decoded-header limits where fixes are unavailable.