Skip to content
CDN Tsunami: New HTTP/3 to HTTP/1.1 DoS Attack Amplifies Traffic Significantly

CDN Tsunami: New HTTP/3 to HTTP/1.1 DoS Attack Amplifies Traffic Significantly

First seen 20 Aug 2026, 16:31 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •August 21, 2026 at 16:19 UTC
  • •CDN Tsunami attacks exploit the gap between HTTP/3 and HTTP/1.1 protocols.
  • •Amplification factors can reach up to 350x, affecting major CDN providers.
  • •Two attack variants, HBA and HCA, target bandwidth and connection exhaustion.

A new class of Denial-of-Service (DoS) attacks, termed CDN Tsunami, exploits the protocol translation gap between HTTP/3 at the CDN edge and HTTP/1.1 to the origin server. This vulnerability affects six major CDN providers, including Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, and Tencent. Attackers can amplify small HTTP/3 traffic into massive HTTP/1.1 requests, achieving amplification factors of up to 350x. Two attack variants have been identified: HTTP/3 Bandwidth Amplification (HBA) and HTTP/3 Connection Amplification (HCA). Over 42,000 subdomains in the Tranco Top 1M are potentially vulnerable. As of August 2026, no CVE has been assigned, and no exploitation in the wild has been reported. Mitigations have been deployed by Baidu and Tencent, while other vendors have acknowledged the issue but have not yet remediated. The root cause is the heterogeneous protocol deployment in CDNs.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 45d ago How this analysis works

Timeline

2022-05-11
CVE-2022-30592 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-08-20
CDN Tsunami vulnerability disclosed
Research reveals a new DoS attack exploiting HTTP/3 to HTTP/1.1 protocol translation in six major CDNs.
Rescana
2026-08-20
Research paper published on DoS attacks
A study published on arXiv details the first analysis of DoS attacks against HTTP/3 protocols deployed at CDNs.
arxiv.org
2026-08-20
Mitigations deployed by Baidu and Tencent
Baidu and Tencent have acknowledged the vulnerability and implemented mitigations, while others have not yet remediated.
Rescana

More articles in this cluster (2)

Following this threat?

Track Alibaba in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 2