CDN Tsunami: New HTTP/3 to HTTP/1.1 DoS Attack Amplifies Traffic Significantly

A new class of Denial-of-Service (DoS) attacks, termed CDN Tsunami, exploits the protocol translation gap between HTTP/3 at the CDN edge and HTTP/1.1 to the origin server. This vulnerability affects six major CDN providers, including Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, and Tencent. Attackers can amplify small HTTP/3 traffic into massive HTTP/1.1 requests, achieving amplification factors of up to 350x. Two attack variants have been identified: HTTP/3 Bandwidth Amplification (HBA) and HTTP/3 Connection Amplification (HCA). Over 42,000 subdomains in the Tranco Top 1M are potentially vulnerable. As of August 2026, no CVE has been assigned, and no exploitation in the wild has been reported. Mitigations have been deployed by Baidu and Tencent, while other vendors have acknowledged the issue but have not yet remediated. The root cause is the heterogeneous protocol deployment in CDNs.

Key Points: • CDN Tsunami attacks exploit the gap between HTTP/3 and HTTP/1.1 protocols. • Amplification factors can reach up to 350x, affecting major CDN providers. • Two attack variants, HBA and HCA, target bandwidth and connection exhaustion.