QPACK amplification attacks against HTTP/3 servers (Header Accordions)

What happened and what to do

The post by Fox-IO, relayed on the oss-sec mailing list by Alan Coopersmith on 21 October 2026, reports QPACK amplification attacks against HTTP/3 servers and presents the technique under the name Header Accordions. The original publication provides a detailed analysis of the mechanism, which concerns HTTP/3 header compression and how it can be used to amplify traffic sent to a target.

In practice, a company can start by inventorying every HTTP/3 and QUIC endpoint it exposes, including reverse proxies, load balancers and third-party CDNs, and checking which are active and with which header compression settings. It can then apply header size and request rate limits, confirm with each vendor which fixes are available for each component, and validate these changes in staging with controlled traffic. It is also worth monitoring the ratio of inbound to outbound bytes per connection, with alerts for abnormal spikes, so that this kind of attack is detected without relying on manual analysis.

How the consultancy can help

Assessment of the exposure of HTTP/3 servers, proxies and CDNs to QPACK amplification attacks, with an inventory of versions and settings, and implementation of header limits, amplification monitoring and alerts in the client's own or contracted infrastructure.

Next step

If your company operates its own HTTP/3 services or services contracted from third parties, send a short description of the scenario, the infrastructure and the exposed services, and receive a scoped proposal for diagnosis and implementation.