CDN Tsunami: Exploiting HTTP/3-HTTP/1.1 Conversion for DoS Attacks

2026-07-29

AI Summary

This study uncovers a novel denial-of-service (DoS) attack surface arising from protocol translation mismatches between HTTP/3 and HTTP/1.1 in heterogeneous deployments involving content delivery networks (CDNs) and origin servers. Specifically, when a CDN supports HTTP/3 while the origin server only supports HTTP/1.1, the authors propose two exploitation techniques—HTTP/3 Connection Amplification (HCA) and Header Byte Amplification (HBA)—that significantly amplify traffic volume or concurrent connections to exhaust origin server resources. A large-scale scan of the Tranco Top 1M domains identified 42,330 potentially vulnerable subdomains. The findings were validated by two major CDN providers, who acknowledged the vulnerability and deployed mitigations, thereby marking the first systematic exposure of security risks introduced by HTTP/3 adoption.

Abstract

Content Delivery Networks (CDNs) provide high availability, accelerate content delivery for their host websites, but are also vulnerable to different types of Denial-of-Service (DoS) attacks. Prior works have studied a variety of DoS attacks with HTTP/1.1 or HTTP/2 connections, but most of them are being fixed, making CDNs robust against such attacks. One unexplored research area is how the recent introduction of HTTP/3 at CDNs affects the DoS attack landscape, especially when there are heterogeneous deployments of HTTP/3 and HTTP/1.1 between CDNs and host websites. In this paper, we design the first study of DoS attacks against HTTP/3 protocols deployed at CDNs. Our key insight is that when the CDN adopts HTTP/3 but the host websites use HTTP/1.1, an adversary can utilize the disparity to amplify a small amount of traffic to the CDN using HTTP/3 to a large amount from the CDN to the host website using HTTP/1.1. More specifically, we design two attack variations-HTTP/3 Bandwidth Amplification (HBA) and HTTP/3 Connection Amplification (HCA)-targeting the bandwidth and the number of connections, respectively. Furthermore, we conduct a large-scale measurement upon the Tranco Top 1M domain list to quantify the real-world impact of these attacks, identifying 42,330 subdomains that are potentially vulnerable to our attacks. Finally, we responsibly disclose the details of our attacks to the affected CDN vendors: so far, two vendors have already acknowledged their vulnerabilities with bounties and have deployed our mitigations.

Problem

• DoS attack
• HTTP/3
• Content Delivery Network
• protocol conversion
• amplification

Innovation

• HTTP/3
• DoS attack
• CDN
• protocol conversion
• amplification attack