Incidents

Security Incidents, Live

What Is Exploited Now, And What Fixes It.

Live incidents worldwide: the CVE, whether a patch exists, the versions that fix it and the reports behind it. Updated through the day from pwn.watch.

Scan your code for what attackers use →

Live

Exploited and disclosed, latest first

Each incident names its severity, its patch status and the fixed versions. Open the updates for the dated timeline and its sources.

UnratedOctober 23, 2026, 20:13 UTClivePatch: partial

HTTP/3 QPACK “Header Accordions” memory-amplification DoS

FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.

Fixed in: quic-go 0.57.0, Cloudflare quiche 0.29.3, lsquic 4.9.0, Wireshark 4.6.2 / 4.4.12
CVEs: CVE-2025-64702, CVE-2026-12523, CVE-2025-13945

Latest updates (2)

2026-10-20: FoxIO blog + PoC published; several stacks still unpatched.
2025-11 → 2026-07: Responsible reports to quic-go, quiche, Bun, aioquic, lsquic, h3.

Full timeline on pwn.watch →

Incident data from pwn.watch, updated October 23, 2026, 20:25 UTC. Summaries are pwn.watch's; Sekura did not verify them.