CDN Tsunami Attacks Exploit HTTP/3 Translation for DoS Amplification

CDN Tsunami Attacks Discovered

Cybersecurity researchers have revealed two denial-of-service (DoS) attack methods, collectively termed "CDN Tsunami." These attacks leverage a specific vulnerability in how major Content Delivery Networks (CDNs) handle the translation of client-facing HTTP/3 traffic into HTTP/1.1 requests directed at the origin websites they serve. This translation process can be abused to amplify a low-bandwidth request stream by as much as 350 times against the origin server.

Affected Providers and Amplification Factors

The "CDN Tsunami" attacks were tested against Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, and Tencent. All six providers were found susceptible to the bandwidth variant (HBA), and five were vulnerable to the connection variant (HCA), with Cloudflare being the exception for HCA due to its request buffering. The highest amplification factor of 350x was observed with Alibaba, Baidu, and Tencent, which support the QPACK dynamic table. Other CDNs like Cloudflare, CloudFront, and Fastly showed amplification ranging from 36.41x to 51.2x.

Technical Mechanism of Attack

The two techniques, HTTP/3 Bandwidth Amplification (HBA) and HTTP/3 Connection Amplification (HCA), stem from a deployment gap where CDNs communicate via HTTP/3 with browsers but use HTTP/1.1 with the origin website. HBA specifically exploits QPACK, the header compression format in HTTP/3. Since HTTP/1.1 lacks an equivalent, the CDN must expand small indexed header values into full raw headers before forwarding, causing the origin server to process a significantly larger request than what the attacker initially sent. Attacker-side bandwidth remained below 500 Kbps against the three CDNs supporting the dynamic table and below 5 Mbps against the others.

Mitigation and Industry Response

No CVE identifiers have been assigned, and there are no reports of these attacks being exploited in the wild. Baidu and Tencent have acknowledged the reports and implemented the suggested fixes. The researchers noted that all proposed mitigations are applied at the CDN level, rather than requiring changes at the origin website.