The attacks work by exploiting the protocol conversion process built into many CDN edge nodes. When a client speaks HTTP/3—typically over QUIC—the CDN unwraps that traffic and re-encodes it as HTTP/1.1 before forwarding it upstream. In specific implementations, this translation step can inflate a seemingly tiny request stream into a much heavier workload for the origin.

The research team evaluated CDN Tsunami against several major providers, including Alibaba and Baidu. The core issue lies in how these edge nodes handle specific HTTP/3 features or frame sequences during the conversion to HTTP/1.1, allowing an attacker to send a sparse set of requests from a single connection and force the CDN into generating a massive burst of requests toward the website's server.

Key details from the evaluation:

• Attack type: Denial-of-service via protocol translation (HTTP/3 to HTTP/1.1)
• Amplification factor: Up to 350x from a low-bandwidth source stream
• Target surface: Origin servers behind participating CDN edge nodes
• Tested providers: Alibaba, Baidu

No specific patch or CVE identifier has been attached to this research at the time of publication. The findings emphasize that the amplification potential depends on the CDN's internal request-generation logic rather than a single software bug. Mitigation strategies would likely involve tightening CDN rate controls, monitoring per-connection upstream request counts, and validating the request patterns your origin actually receives from edge nodes.

Source: The Hacker News

Are any of your edge-to-origin configurations exposed to this kind of translation abuse, and have you checked your CDN's rate-limit thresholds for HTTP/3 to HTTP/1.1 conversion spikes?