CDN 'Tsunami' Attacks Exploit HTTP/3 Translation to Amplify DoS Traffic 350x

Researchers have uncovered two new denial-of-service (DoS) attack vectors that allow attackers to overwhelm backend servers by exploiting how Content Delivery Networks (CDNs) handle modern web traffic. The vulnerabilities, termed HTTP/3 Bandwidth Amplification (HBA) and HTTP/3 Connection Amplification (HCA), leverage a translation gap at the CDN edge to multiply attack traffic by up to 350 times.

The attacks target a specific "deployment gap" where CDNs communicate with clients using the high-performance HTTP/3 protocol but translate that traffic back to the older HTTP/1.1 standard when communicating with origin servers. By abusing QPACK header compression and HTTP/3 multiplexing, attackers can send low-bandwidth request streams that the CDN then expands into massive volumes of traffic directed at the origin. Bandwidth amplification factors reached 350x for providers supporting QPACK dynamic tables—specifically Alibaba, Baidu, and Tencent—while providers using only static tables saw amplification ranging from 36.41x to 66.06x.

The Infrastructure Gap

This vulnerability is rooted in a systemic lack of end-to-end HTTP/3 support across the web's infrastructure. Because CDNs do not support end-to-end HTTP/3, a mismatch occurs in how headers and connections are managed between the network edge and the backend. This research builds upon a 2020 study known as "CDN Judo," which examined similar issues during the conversion of HTTP/2 to HTTP/1.1. These findings suggest that as the industry migrates to HTTP/3, these translation layers introduce new, severe security risks.

Industry Impact

In a study of six major providers—Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, and Tencent—researchers found that most were susceptible to bandwidth amplification, and five were vulnerable to connection amplification. Cloudflare was the only provider unaffected by the HCA variant because it buffers complete requests before establishing a connection to the origin server. The scale of the risk is significant; a probe of the Tranco Top 1M subdomains identified 42,330 potentially vulnerable sites across these six providers.

Why It Matters

This flaw fundamentally shifts the power dynamic of a DoS attack. An attacker with extremely limited bandwidth—under 500 Kbps in some instances—can generate a "tsunami" of over 100 Mbps of traffic hitting a backend server. Because the amplification occurs within the CDN's own infrastructure, the attack bypasses traditional client-side bandwidth constraints. Crucially, because the vulnerability exists in the translation layer, website owners cannot fix the issue themselves; mitigations must be implemented by the CDN providers to secure the translation process.