CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification

Researchers have uncovered a new class of denial-of-service attacks that weaponize a fundamental translation process built into major content delivery networks, amplifying attacker traffic by up to 350 times before striking origin servers.

The attacks, named "CDN Tsunami," exploit how CDNs like Alibaba and Baidu convert HTTP/3 requests from clients into HTTP/1.1 communication with backend origin servers. An attacker can send a small, low-bandwidth HTTP/3 request through the CDN, which then expands it dramatically when translating to HTTP/1.1 for delivery to the target website. This amplification mechanism turns modest attacker resources into crushing traffic volumes hitting unprotected infrastructure.

HTTP/3 uses QUIC, a modern transport protocol built atop UDP. The protocol introduces different packet structures and header compression than its predecessors. When CDNs receive HTTP/3 traffic destined for websites using older HTTP/1.1 backends, they must translate between these incompatible standards. Researchers discovered that this translation process creates exploitable inefficiencies. A single, compact HTTP/3 request can transform into multiple larger HTTP/1.1 packets when passed to the origin. By flooding CDNs with carefully crafted HTTP/3 requests, attackers force amplified attack traffic toward vulnerable servers behind them.

The attack proves effective because it operates within the normal traffic handling pipeline of CDNs, which trust their own internal traffic. Most DoS defenses focus on detecting malicious external requests. CDN Tsunami bypasses this approach by leveraging legitimate CDN infrastructure itself as the amplification vector. The CDN does not recognize the traffic as anomalous because it performs standard protocol translation operations.

Testing revealed 350x amplification ratios against certain configurations, though amplification factors varied depending on the specific CDN implementation and request crafting techniques employed. An attacker sending 1 megabit per second of HTTP/3 traffic could theoretically generate 350 megabits per second striking the origin server. For websites with limited bandwidth or unoptimized infrastructure, such attack volumes cause immediate service disruption.

The vulnerability stems from no inherent design flaw in HTTP/3 or HTTP/1.1 individually. Rather, the translation layer itself creates the attack surface. CDNs designed their translation processes for correctness and compatibility, not amplification resistance. They prioritize faithful conversion of protocol semantics while accepting some bandwidth overhead. This trade-off, reasonable for legitimate traffic, becomes dangerous when weaponized at scale.

Researchers tested the attack against major CDN providers, confirming that Alibaba and Baidu remain vulnerable. The findings suggest other large CDNs using similar translation mechanisms face identical risks. The research was disclosed responsibly, giving vendors time to implement mitigations before public disclosure.

Organizations depending on CDNs for DDoS protection should recognize that this research reveals a gap in defense assumptions. Traditional CDN filtering mechanisms assume threats originate externally. CDN Tsunami originates from seemingly legitimate client traffic, translated harmlessly by CDN infrastructure itself. Mitigation strategies require either protocol-level changes at CDNs, stricter rate limiting on HTTP/3 to HTTP/1.1 translation, or origin servers implementing independent amplification detection.

Website operators running vulnerable configurations face immediate risk. Those with origin servers directly exposed or running on modest bandwidth connections should request their CDN provider confirm their HTTP/3 translation implementation resists amplification attacks. CDN providers must update their conversion logic to detect and rate-limit translation patterns that produce disproportionate downstream traffic.