Full Report
Cybersecurity researchers have disclosed two denial-of-service (DoS) attacks that exploit how major content delivery networks (CDNs) convert client-facing HTTP/3 traffic into HTTP/1.1 requests to the websites they front, amplifying a low-bandwidth request stream by up to 350x against the origin server. The attacks, collectively named "CDN Tsunami," were evaluated against Alibaba, Baidu,
Analysis Summary
# Tool/Technique: CDN Tsunami
## Overview
**CDN Tsunami** is a set of denial-of-service (DoS) amplification attacks that exploit the protocol translation gap in Content Delivery Networks (CDNs). The attack leverages the architectural discrepancy where CDNs accept **HTTP/3 (QUIC)** traffic from clients but communicate with origin servers using **HTTP/1.1**. By abusing HTTP/3 features like QPACK header compression and stream multiplexing, attackers can amplify low-bandwidth request streams to overwhelm origin servers.
## Technical Details
- **Type:** Technique (Denial-of-Service Amplification)
- **Platform:** Web Infrastructure (Targeting origin servers behind CDNs including Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, and Tencent)
- **Capabilities:** Bandwidth amplification (up to 350x), connection exhaustion, and resource depletion.
- **First Seen:** Public disclosure August 20, 2026.
## MITRE ATT&CK Mapping
- **[TA0040 - Impact]**
- **[T1498 - Network Denial of Service]**
- **[T1498.001 - Direct Network Flood]**
- **[T1499 - Endpoint Denial of Service]**
- **[T1499.002 - Service Exhaustion]**
## Functionality
### Core Capabilities
The "CDN Tsunami" consists of two distinct attack variants:
1. **HTTP/3 Bandwidth Amplification (HBA):**
* **Mechanism:** Exploits **QPACK** (the HTTP/3 header compression format). Because HTTP/1.1 does not support compression, the CDN must decompress small, indexed HTTP/3 headers into large, raw HTTP/1.1 strings before forwarding them to the origin.
* **Amplification:** A few bytes of attacker traffic can result in kilobytes of traffic hitting the origin server.
2. **HTTP/3 Connection Amplification (HCA):**
* **Mechanism:** Exploits HTTP/3's multiplexing. A single QUIC connection can hold multiple streams. Many CDNs open a new backend HTTP/1.1 TCP connection to the origin for *every* stream as soon as headers are received.
* **Impact:** Attackers can exhaust the origin server's connection pool (e.g., Apache's `MaxConnections`) with minimal client-side resources.
### Advanced Features
* **Dynamic Table Abuse:** In CDNs supporting the QPACK dynamic table (Alibaba, Baidu, Tencent), attackers can seed the CDN's memory with a large custom header (up to 3,072 bytes) and reference it repeatedly with tiny index values, achieving the maximum 350x amplification factor.
* **Slow-Drip Exhaustion:** In HCA attacks, sending DATA frames at an extremely low rate keeps backend connections "hanging" and occupied, bypassing simple timeout mechanisms.
## Indicators of Compromise
* **File Hashes/Names:** N/A (Protocol-based attack, no specific malware file).
* **Network Indicators:**
* High volume of HTTP/1.1 requests from known CDN IP ranges with unusually large or repetitive headers.
* Disproportionate ratio of incoming HTTP/1.1 connections from CDN edges compared to actual client traffic.
* Targeted URLs may include those fronted by `cloudflare[.]com`, `cloudfront[.]net`, or other major CDN providers.
* **Behavioral Indicators:**
* Origin server logs showing a surge in HTTP 504 (Gateway Timeout) or 503 (Service Unavailable) errors.
* Rapid exhaustion of TCP connection slots while ingress bandwidth from the CDN appears relatively low.
## Associated Threat Actors
* No specific groups have been identified exploiting this in the wild; currently disclosed as academic research.
## Detection Methods
* **Signature-based:** Monitor for HTTP/1.1 requests containing massive, repetitive, or nonsensical headers originating from CDN IP addresses.
* **Behavioral:** Implement monitoring for "Protocol Asymmetry"—detecting when a single client session (via CDN headers like `X-Forwarded-For`) triggers an abnormal number of concurrent backend connections.
* **Origin Analysis:** Profile the average size of headers. A sudden 50x-300x increase in header-to-body ratio is a strong indicator of HBA.
## Mitigation Strategies
* **CDN-Side Fixes (Primary):** CDNs should buffer the entire HTTP/3 request (including the body) before opening a backend connection and implement strict limits on QPACK decompression ratios.
* **End-to-End HTTP/3:** Transitioning origin servers to support HTTP/3 natively removes the translation gap required for the attack.
* **Origin Hardening:**
* Shorten `Keep-Alive` and connection timeouts.
* Increase the maximum concurrent connection limit where resources allow.
* Implement rate-limiting based on the original client IP (using `X-Forwarded-For` or `True-Client-IP` headers).
## Related Tools/Techniques
* **HTTP/2 Rapid Reset (CVE-2023-44487):** A similar DoS technique exploiting stream multiplexing.
* **HTTP Header Oversize Attacks:** General class of attacks abusing header processing.
* **Slowloris:** Related to the HCA variant's ability to hold connections open indefinitely.