Recent research highlights two significant denial-of-service (DoS) vulnerabilities leveraging the conversion of HTTP/3 traffic to HTTP/1.1 by major content delivery networks (CDNs). Known as the ‘CDN Tsunami’ attacks, they can amplify minimal bandwidth requests by up to 350 times against the origin server.
Vulnerable CDNs and Attack Mechanisms
The study evaluated six key CDNs: Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, and Tencent. It found all six vulnerable to the bandwidth amplification variant, while Cloudflare remained immune to the connection variant due to its specific request buffering method.
The attacks require HTTP/3 to be active on the CDN edge, with no modifications needed by the website itself. Notably, while HTTP/3 is advertised as available on Cloudflare by default, AWS documents suggest HTTP/2 as the default for new CloudFront setups.
The Mechanics of HTTP/3 Amplification
These attacks capitalize on the differences between HTTP/3 and HTTP/1.1. The QPACK dynamic table, used for compressing headers in HTTP/3, plays a crucial role. CDNs supporting this feature, like Alibaba, Baidu, and Tencent, can experience a dramatic 350x amplification. The amplification stems from transforming the compressed header indices into full headers for HTTP/1.1 requests.
The research indicates that bandwidth required by attackers stayed under 500 Kbps for CDNs with dynamic table support, while origin bandwidth consumption exceeded 100 Mbps. The attack effectiveness diminishes with more concurrent streams, likely due to increased CPU overhead at the CDN.
Mitigations and Industry Response
Proposed mitigations focus on limiting header sizes and references in the QPACK table and imposing restrictions on CDN-to-origin connections. Tencent has begun implementing these changes, while other vendors are still considering them.
The research, credited to several universities, will be presented at an upcoming symposium in 2026. No CVE identifiers have been assigned, and no real-world exploits have been reported. However, some vendors have already acknowledged the findings and are exploring solutions.
The findings underscore a shift in cyber threat dynamics, with amplification and reflection attacks becoming more prevalent, as highlighted in Cloudflare’s recent DDoS Threat Report.
