CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification
Researchers disclosed two DoS attacks exploiting CDNs' HTTP/3-to-HTTP/1.1 translation to amplify low-bandwidth requests up to 350x against origin servers.
Researchers named the two techniques HTTP/3 Bandwidth Amplification (HBA) and HTTP/3 Connection Amplification (HCA), exploiting the gap where CDNs speak HTTP/3 to browsers but only HTTP/1.1 to origins. All six tested CDNs (Alibaba, Baidu, Cloudflare, CloudFront, Fastly, Tencent) were susceptible to HBA, and five to HCA, with Cloudflare immune to HCA because it buffers full requests before opening backend connections. Attackers using under 5 Mbps forced over 100 Mbps at origins, and the 350x factor applies only to Alibaba, Baidu, and Tencent, which support the QPACK dynamic table. Testing identified 42,330 potentially vulnerable subdomains out of 151,685 hosted on the six providers across the Tranco Top 1M.
- HBA exploits QPACK header compression, expanding small index values into full HTTP/1.1 headers at the origin
- HCA forces premature backend connections via HTTP/3 multiplexing, causing 503/504 timeouts at five CDNs
- Cloudflare avoids HCA by buffering complete requests before opening origin connections
- No CVEs assigned; no in-the-wild exploitation reported; Baidu and Tencent deployed fixes
- Attack surpasses 2020's CDN Judo, which reached roughly 166x with dynamic tables
- Organizations
- The Hacker News
From the original article
6 min read at thehackernews.com
Cybersecurity researchers have disclosed two denial-of-service (DoS) attacks that exploit how major content delivery networks (CDNs) convert client-facing HTTP/3 traffic into HTTP/1. 1 requests to the websites they front, amplifying a low-bandwidth request stream by up to 350x against the origin server.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.