Cybersecurity / FoxIOthe 25th of October 2026, 17:30 UTC

Web flaw crashes 7 in 10 servers, FoxIO says

One connection can crash 7 of the 10 HTTP/3 web programs FoxIO tested, the security firm said on the 20th of October 2026. Fixes are out for 4 of the 7.

FoxIO: HTTP/3 flaw hits 7 of 10 programs

FoxIO, a security company, said on the 20th of October 2026 that a web flaw can crash 7 of the 10 web programs it tested. One connection from an attacker is enough, and no password is needed, FoxIO wrote in its report.

FoxIO named the flaw Header Accordions. Fixes are out for 4 of the 7 programs, and 3 had no fix on the 20th of October, the report said.

FoxIO found the flaw in HTTP/3, the newest way web pages load

A server is a computer that sends web pages to your browser. HTTP/3 is the newest set of rules that browsers and servers use to talk.

Each request carries headers, which are short labels such as the browser's name. HTTP/3 packs headers small, and the flaw makes a server unpack them into far more memory than it got, FoxIO wrote.

4 fixes are out, for quic-go, Cloudflare's quiche, lsquic and Wireshark

The fixed versions are quic-go 0.57.0, Cloudflare's quiche 0.29.3, lsquic 4.9.0 and Wireshark 4.6.2, FoxIO wrote. These are free programs that many web firms build on.

Oven's Bun 1.4.3, the h3 project and aioquic had no fix on the 20th of October, FoxIO wrote. It told Bun users to keep HTTP/3 servers off the open internet for now.

Below we break down the 7 in 10 figure

FoxIO tests: memory used for each byte sent was about 15 times in quic-go, about 20 times in Cloudflare's quiche, 20 to 30 times in aioquic, 600 to 1,800 times in lsquic and about 4,000 times in Oven's Bun

Seven of 10 is 70% of the programs FoxIO tested. Four of the 7 have fixes, so 3 in 7, or about 43%, were still open, by our arithmetic.

In FoxIO's tests, Bun turned each byte sent into about 4,000 bytes of memory. At that rate, 1 kilobyte sent could fill about 4 megabytes, by our arithmetic.

The 7 in 10 figure counts only the 10 programs FoxIO tested. It leaves out how many websites run them, which FoxIO did not give.

What is confirmed and what is not

Google's quiche, Microsoft's IIS web server and ngtcp2 passed FoxIO's test. FoxIO's report describes lab tests and gives no count of real attacks.

Key facts

FoxIO published the Header Accordions flaw on the 20th of October 2026.

7 of 10 tested HTTP/3 programs could be crashed.

One connection is enough, with no password needed.

Fixed: quic-go 0.57.0, Cloudflare's quiche 0.29.3, lsquic 4.9.0, Wireshark 4.6.2.

No fix on the 20th of October for Oven's Bun, h3 and aioquic.

Source: FoxIO, Header Accordions report, the 20th of October 2026