QPACK

Security researchers at Foxio have detailed a new class of amplification attacks targeting HTTP/3 servers, exploiting QPACK header compression to make small requests trigger disproportionately large responses. The writeup, described as "header accordions," shows how attackers could abuse the protocol to overwhelm targets. The finding prompts questions about how widely deployed HTTP/3 implementations are exposed.