Post

this is a bit of a jump scare after a long... day... but the timeline on this was almost a year and many things are patched. in particular, the PDS reference distro uses caddy (with QUIC HTTP3). but it self-updates and has been patched for some time. if you run caddy for other stuff, update it

Xe@xeiaso.net

HTTP/3 compression bomb: foxio.io/blog/header-...

foxio.ioHeader Accordions: QPACK amplification attacks against HTTP/3 servers - FoxIO | Cyber InnovationWe solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.

bryan newbold

@bnewbold.net

you can check if a service is doing HTTP/3 with: curl --http3-only pds.example.com -vvv if this prints periodic failures, the server isn't really doing HTTP/3.

22/10/26, 2:48 am2 reposts5 likes

bryan newbold

@bnewbold.net

the original post mentions CVE-2025-64702 for quic-go, but note that CVE-2026-40898 (June 2026) for HTTP trailers, from June 2026, was very similar and only patched in quic-go v0.59.1 caddy uses quic-go. recent caddy versions (eg, my PDS is running v2.11.7) have been patched for a while.

bryan newbold

@bnewbold.net

if your PDS host does not use watchtower for automatic docker container updates, you should probably update the caddy container. if you use caddy for other projects and haven't updated in a few months, you should probably also update caddy.