CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification
CDN Tsunami attacks exploit HTTP/3 to HTTP/1.1 translation for DoS amplification.
Cybersecurity researchers have discovered two denial-of-service (DoS) attacks, dubbed 'CDN Tsunami,' that exploit the translation process from HTTP/3 to HTTP/1.1 used by major CDNs. These attacks can amplify low-bandwidth requests by up to 350x against origin servers. While Baidu and Tencent have deployed fixes, the researchers note that mitigations are applied at the CDN level, not the origin.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Alibaba?
Get an email when a new story names Alibaba, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe CDN Tsunami attack exploits a fundamental design weakness in how major CDNs translate HTTP/3 requests into HTTP/1.1 when forwarding traffic to origin servers, allowing attackers to amplify low-bandwidth requests up to 350 times. The root problem lies in misconfigured or unvalidated protocol translation logic that fails to account for header multiplication and request expansion between protocol versions. Because mitigations are applied at the CDN layer rather than the origin, servers without additional protection remain exposed even when CDN-level fixes are deployed. This matters because organizations often treat CDNs as a complete shield, creating a dangerous false sense of security for origin infrastructure. Relying solely on third-party mitigations without hardening origin servers is an architectural risk that attackers can exploit directly.
What helps against this
How we list vendors
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Next-generation firewall and intrusion prevention
Malicious traffic is blocked at the network edge and between zones.
- Web application firewall and DDoS protection
Websites and APIs stay up, and common web attacks are filtered before they reach them.