CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification
Two new DoS attack vectors (HBA and HCA) exploit HTTP/3-to-HTTP/1.1 translation gaps at major CDNs, achieving up to 350x bandwidth amplification against origin servers Six CDNs tested (Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, Tencent) — all vulnerable to bandwidth amplification, five of six to connection exhaustion Attacks require zero configuration changes on the origin side and leverage QPACK header compression differences between HTTP/3 and HTTP/1.1 An estimated 42,330 subdomain
Analysis
TL;DR
- Two new DoS attack vectors (HBA and HCA) exploit HTTP/3-to-HTTP/1.1 translation gaps at major CDNs, achieving up to 350x bandwidth amplification against origin servers
- Six CDNs tested (Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, Tencent) — all vulnerable to bandwidth amplification, five of six to connection exhaustion
- Attacks require zero configuration changes on the origin side and leverage QPACK header compression differences between HTTP/3 and HTTP/1.1
- An estimated 42,330 subdomains across the Tranco Top 1M are potentially vulnerable, with CloudFront, Cloudflare, and Fastly having the largest exposure
- No CVE assigned and no in-the-wild exploitation reported; mitigations are CDN-side only and include QPACK dynamic table entry size limits and reference frequency caps
Why It Matters
This research exposes a systemic architectural weakness in how CDNs translate between HTTP/3 at the edge and HTTP/1.1 at the origin — a gap that turns legitimate protocol features into powerful amplification vectors. For AI practitioners and infrastructure teams relying on CDN-hosted services, it highlights that protocol modernization at the edge without end-to-end consistency creates exploitable asymmetries with real availability consequences.
Technical Details
- HTTP/3 Bandwidth Amplification (HBA): Exploits QPACK header compression by sending small index values that reference large headers stored in the CDN's dynamic table. The CDN must decompress these into full HTTP/1.1 headers before forwarding to the origin. Alibaba, Baidu, and Tencent achieve up to ~66x amplification using the dynamic table; Cloudflare, CloudFront, and Fastly reach 36–51x via the static table alone. Attacker bandwidth stayed below 500 Kbps–5 Mbps while origin consumption exceeded 100 Mbps.
- HTTP/3 Connection Amplification (HCA): Leverages HTTP/3 multiplexing to open many backend TCP connections with minimal client effort. A single HTTP/3 connection carrying 96 streams can force 96 separate HTTP/1.1 connections at the origin. Five CDNs open backend connections upon receiving the HEADERS frame before the body arrives; Fastly limits this to 10 backend connections per HTTP/3 connection. Four attacker connections were sufficient to exhaust a 256-connection-limit Apache server.
- Dynamic table constraints: Alibaba, Baidu, and Tencent advertise 4KB dynamic tables with a maximum entry size of 3,072 bytes. The amplification peaks at approximately 64 concurrent streams and then declines, attributed to CPU overhead at the CDN edge (unmeasured in the study).
- Scope assessment: Researchers enumerated 151,685 subdomains under the Tranco Top 1M, identified 42,330 responding to HTTP/3 probes as potentially vulnerable. CloudFront led with 17,431, followed by Cloudflare (12,371) and Fastly (11,606). No origin servers outside the controlled test environment were attacked.
- Comparison to prior work: The 2020 "CDN Judo" study found similar amplification for HTTP/2-to-HTTP/1.1 translation at ~44x (static table) and ~166x (dynamic table). HTTP/3's QPACK enables even higher factors, particularly with dynamic table exploitation.
- Mitigations proposed: Cap QPACK dynamic table entry sizes at 512 bytes and limit references to any single dynamic table entry to no more than 10 times per stream. All mitigations are applied at the CDN layer, not the origin.
Industry Insight
- End-to-end HTTP/3 adoption is a security imperative: The fundamental mismatch — HTTP/3 at the edge, HTTP/1.1 at the origin — is the root cause. CDNs that implement full HTTP/3-to-HTTP/3 upstream translation would eliminate both HBA and HCA attack surfaces entirely.
- HTTP/3 default-enablement increases exposure: With Cloudflare and CloudFront enabling HTTP/3 by default for new distributions, the attack surface has grown passively. Organizations should audit their CDN configurations and advocate for origin-side protections even as edge protocol support expands.
- Mitigation burden falls on CDNs, not origin operators: Since all proposed fixes are CDN-side and no origin-level countermeasures exist, website operators have limited recourse beyond switching providers. This creates a collective action problem where individual sites cannot fully protect themselves without vendor cooperation — reinforcing the need for industry-wide standards and potentially CVE-assigned vulnerabilities to drive urgency.
Disclaimer: The above content is generated by AI and is for reference only.