CDN Tsunami: Exploiting HTTP/3-HTTP/1.1 Conversion for DoS Attacks

Researchers found a new DoS risk in CDNs that convert HTTP/3 traffic to HTTP/1.1.

The paper describes two attack modes: bandwidth amplification and connection amplification.

A scan of the Tranco Top 1M found 42,330 potentially vulnerable subdomains.

The issue was disclosed to vendors, and some confirmed the bug and shipped mitigations.