CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification
-
Researchers have identified two denial-of-service (DoS) attack techniques that abuse how large content delivery networks (CDNs) translate inbound HTTP/3 requests into HTTP/1.1 traffic destined for origin servers. Dubbed CDN Tsunami, these attack vectors achieve a low-bandwidth amplification factor of up to 350x against the target backend.
The attacks work by exploiting the protocol conversion process built into many CDN edge nodes. When a client speaks HTTP/3—typically over QUIC—the CDN unwraps that traffic and re-encodes it as HTTP/1.1 before forwarding it upstream. In specific implementations, this translation step can inflate a seemingly tiny request stream into a much heavier workload for the origin.
The research team evaluated CDN Tsunami against several major providers, including Alibaba and Baidu. The core issue lies in how these edge nodes handle specific HTTP/3 features or frame sequences during the conversion to HTTP/1.1, allowing an attacker to send a sparse set of requests from a single connection and force the CDN into generating a massive burst of requests toward the website's server.
Key details from the evaluation:
- Attack type: Denial-of-service via protocol translation (HTTP/3 to HTTP/1.1)
- Amplification factor: Up to 350x from a low-bandwidth source stream
- Target surface: Origin servers behind participating CDN edge nodes
- Tested providers: Alibaba, Baidu
No specific patch or CVE identifier has been attached to this research at the time of publication. The findings emphasize that the amplification potential depends on the CDN's internal request-generation logic rather than a single software bug. Mitigation strategies would likely involve tightening CDN rate controls, monitoring per-connection upstream request counts, and validating the request patterns your origin actually receives from edge nodes.
Source: The Hacker News
Are any of your edge-to-origin configurations exposed to this kind of translation abuse, and have you checked your CDN's rate-limit thresholds for HTTP/3 to HTTP/1.1 conversion spikes?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login