CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification

Security researchers have identified two denial-of-service vectors, collectively termed "CDN Tsunami," that exploit the conversion of HTTP/3 traffic to HTTP/1.1 by major content delivery networks. By leveraging mismatches in header compression and connection handling, attackers can amplify bandwidth or exhaust origin server connections, with factors reaching up to 350x on platforms like Alibaba, Baidu, and Tencent. Although no CVE has been assigned and no wild exploitation is currently reported, the study indicates significant potential for disruption across six prominent providers. Affected services include Cloudflare, Amazon CloudFront, and Fastly, prompting recommendations for stricter CDN-side limits on header sizes and backend connection multiplicity.