CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification
Summary: Researchers disclosed two denial-of-service attacks, collectively named CDN Tsunami, that exploit CDNs converting client-facing HTTP/3 traffic to HTTP/1.1 at the origin, amplifying a low-bandwidth request stream by up to 350x. All six tested providers - Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, and Tencent - were susceptible to the bandwidth variant and five to the connection variant, with no CVE assigned and no exploitation in the wild reported.
Why it matters: Attacker bandwidth stayed below 500 Kbps while origin consumption exceeded 100 Mbps throughout, and the researchers' scan found 42,330 of 151,685 subdomains across the six providers responding to HTTP/3 and labeled potentially vulnerable. Every mitigation proposed is applied at the CDN rather than at the origin website, so a site hosted on one of these providers has no configuration change of its own that closes the gap.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026