HTTP/3-to-HTTP/1.1 Translation Flaw Enables 350x DoS Amplification via CDNs
The CDN Tsunami attack exploits a fundamental design weakness in how major CDNs translate HTTP/3 requests into HTTP/1.1 when forwarding traffic to origin servers, allowing attackers to amplify low-bandwidth requests up to 350 times. The root problem lies in misconfigured or unvalidated protocol translation logic that fails to account for header multiplication and request expansion between protocol versions. Because mitigations are applied at the CDN layer rather than the origin, servers without additional protection remain exposed even when CDN-level fixes are deployed. This matters because organizations often treat CDNs as a complete shield, creating a dangerous false sense of security for origin infrastructure. Relying solely on third-party mitigations without hardening origin servers is an architectural risk that attackers can exploit directly.
Tactical Insight
Immediate actions
- Confirm whether your CDN provider (especially Baidu, Tencent, or others using HTTP/3 gateways) has deployed patches for the CDN Tsunami vulnerability.
- Implement origin-side rate limiting and request throttling independent of CDN-level controls to reduce amplification impact.
- Temporarily restrict direct origin server access to only known CDN IP ranges while vendor patches are assessed.
Long-term improvements
- Audit CDN configuration to ensure HTTP/3 translation settings enforce strict header size and request count limits at the edge.
- Adopt a defense-in-depth architecture so origin servers have independent DDoS protections rather than relying solely on CDN mitigation.
- Maintain an up-to-date inventory of all internet-facing services and their dependency on CDN protocol translation features.
Detection measures
- Deploy anomaly-based traffic monitoring at the origin to detect sudden spikes in HTTP/1.1 request volume inconsistent with expected CDN throughput.
- Set alerting thresholds for request amplification ratios between edge and origin layers to identify exploitation attempts early.
- Integrate CDN access logs with your SIEM to correlate protocol-level anomalies with origin server load metrics in near real-time.