HTTP/3 Flaws Can Crash Web Servers: What to Check

On October 20, 2026, security firm FoxIO published research on HTTP/3, the newest version of the web's core protocol. Seven of the ten implementations it tested are vulnerable, and in some a single connection is enough to run the server out of memory. Sites served over HTTP/3 by unpatched software, LiteSpeed's included, are exposed.

What we know

What it is: HTTP/3 compresses each request's headers with a scheme called QPACK. According to FoxIO, the affected implementations lack limits when decompressing, or apply them too late. A remote client, without logging in, can make the server allocate tens to thousands of times more memory than it sends.
What it causes: the server runs out of memory or pins its CPU. It's a denial of service: the research doesn't describe data theft or code execution.
What's fixed, according to FoxIO as of October 20: quic-go in 0.57.0 (CVE-2025-64702), Cloudflare's quiche in 0.29.3 (CVE-2026-12523), lsquic in 4.9.0, released July 15, 2026, with no CVE, and Wireshark in 4.6.2 and 4.4.12 (CVE-2025-13945).
What's still unfixed: Bun's HTTP/3 server (version 1.4.3), the h3 Rust library and aioquic/mitmproxy. FoxIO advises not exposing Bun's HTTP/3 server and turning HTTP/3 off in mitmproxy.
Not affected: Microsoft IIS, Envoy, ngtcp2/nghttp3 and Google's quiche, according to the research.
Where those libraries run: quic-go is behind Caddy, Traefik and cloudflared, according to FoxIO. lsquic is LiteSpeed's QUIC library: the research fingerprints OpenLiteSpeed 1.9.1 with lsquic 4.8.2, a version from before the fix.
OpenLiteSpeed: its release log says 1.9.2, from August 6, 2026, updates lsquic to 4.9.3, and 1.9.3, from September 29, moves it to 4.10.0. Both come after the lsquic fix.
LiteSpeed Enterprise: its release log doesn't mention lsquic or QPACK. Its latest stable version is 6.3.7, from September 23, 2026. Those records don't confirm whether it's fixed.
nginx and Apache are not among the implementations FoxIO tested.
Public proof of concept: FoxIO released code that reproduces the flaws, which usually speeds up attack attempts.

What changes and what doesn't

What changes: the flaw and a way to reproduce it are now public. A server with HTTP/3 on and an unpatched library can be knocked over from outside.

Nothing changes if your site doesn't offer HTTP/3, or if its server already ships a fixed version. Several fixes are months old: quic-go's dates from November 2025 and lsquic's from July 2026.

A site that's down loads for no one: not your customers, not Google. A short outage usually has little effect on search. That reading is this article's, not the research's.

How to tell if you're affected

Check whether your site uses HTTP/3. In Chrome, open developer tools, go to "Network" and turn on the "Protocol" column: "h3" means your site uses it. `curl -sI https://yoursite.com` also works: look for an `alt-svc` header with "h3".
Check which server answers. The `server` header in that same response usually says: "LiteSpeed", "Caddy"… If it says "cloudflare", Cloudflare's network handles the connection, not your server, and the research doesn't assess that service.
If you run OpenLiteSpeed yourself, make sure you're on 1.9.2 or later. On 1.9.1 or earlier, update.
If you use Caddy or Traefik, update to the latest version and check that it bundles quic-go 0.57.0 or later.
If your site is on shared hosting with LiteSpeed, the update is your provider's job. Ask: "Which LiteSpeed and lsquic versions do you run? Do they include the lsquic 4.9.0 fix for the QPACK flaws FoxIO published on October 20?"
If you can't update today, turning HTTP/3 off on the server is a temporary way out: browsers fall back to HTTP/2 and the site keeps working.
If you run Bun as an HTTP/3 server, don't expose it to the internet until there's a fix, as FoxIO recommends.

Sources

Updates: this article will be updated if LiteSpeed confirms which Enterprise version ships the fix, or if Bun, h3 or aioquic release one.