CDN Tsunami Attack Exploits HTTP/3 Translation for Up to 350x DoS Amplification

Researchers have disclosed two denial-of-service (DoS) attacks named "CDN Tsunami" that exploit content delivery network (CDN) mechanisms for amplifying traffic against origin servers. The attacks leverage how major CDNs convert client-facing HTTP/3 traffic into HTTP/1.1 requests destined for the websites they front. By abusing this translation process, attackers can amplify a low-bandwidth request stream by up to 350x against the origin server.

The attacks were evaluated against Alibaba and Baidu CDNs, though the researchers indicate that other major CDN providers may be similarly affected. The exploitation targets the inherent translation layer between HTTP/3 and HTTP/1.1 protocols within CDN infrastructure, turning what should be a protocol translation mechanism into an amplification vector.

The disclosure highlights emerging challenges in securing next-generation web infrastructure as HTTP/3 adoption increases. The findings suggest that the translation mechanisms designed to interoperate between protocol versions may contain unintended amplification properties that adversaries can leverage.