Ethical Hacking News
A new denial-of-service attack has been discovered that exploits a vulnerability in content delivery networks (CDNs), allowing attackers to amplify low-bandwidth requests by up to 350 times against the origin server. The attack, dubbed as "CDN Tsunami," has been found to affect six major CDNs, including Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, and Tencent. To mitigate this vulnerability, researchers have proposed several measures, including capping header field entries, limiting dynamic table references, and enforcing maximum decompressed request sizes. As the threat landscape continues to evolve, it is essential for organizations and individuals to stay vigilant and take proactive steps to protect themselves against emerging threats.
CDN Tsunami vulnerability discovered in six major CDNs, including Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, and Tencent. Vulnerability exploits translation of HTTP/3 traffic into HTTP/1.1 requests, amplifying low-bandwidth requests up to 350 times. Attack works by expanding low-bandwidth HTTP/3 request into a full raw header, repeated multiple times to overwhelm origin server. Three CDNs (Alibaba, Baidu, Tencent) particularly vulnerable due to QPACK dynamic table support. Amplification factors measured: Baidu (66.06x), Alibaba (65.8x), Tencent (54.08x), Cloudflare (51.2x), Fastly (48.27x), Amazon CloudFront (36.41x). Cloudflare unaffected, while other five CDNs vulnerable to attack. Response times affected: 60-90 seconds for some CDNs, 15 seconds for Fastly. Mitigation measures proposed, including capping header field entries, limiting dynamic table references, and enforcing request size limits. Tencent has already deployed mitigations, but status unclear for other vendors.
The world of cybersecurity has witnessed numerous attacks over the years, with each one showcasing the constant evolution of threats and vulnerabilities. A recent discovery has shed light on a new vulnerability in content delivery networks (CDNs) that could potentially be exploited to launch denial-of-service (DoS) attacks. This vulnerability, dubbed as "CDN Tsunami," has been found to affect six major CDNs, including Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, and Tencent.
According to a recent report, the vulnerability is caused by the way these CDNs translate HTTP/3 traffic into HTTP/1.1 requests to the websites they front. The attack exploits this translation process, amplifying low-bandwidth requests by up to 350 times against the origin server. This amplification factor is particularly concerning, as it can lead to significant disruptions in online services and potentially even cause widespread chaos.
The attack works by first sending a low-bandwidth HTTP/3 request, which is then expanded into a full raw header by the CDN. This process is repeated multiple times, allowing the attacker to create a high-volume stream of requests that can overwhelm the origin server. The attack is made possible by the fact that CDNs do not support end-to-end HTTP/3, meaning they only support HTTP/1.1 to the origin server.
The researchers behind the discovery found that the three CDNs that support the QPACK dynamic table - Alibaba, Baidu, and Tencent - are particularly vulnerable to this attack. They also found that the maximum amplification factor measured using the QPACK static table is as follows: Baidu, 66.06x; Alibaba, 65.8x; Tencent, 54.08x. In contrast, Amazon CloudFront, Cloudflare, and Fastly measured amplification factors of 51.2x, 48.27x, and 36.41x, respectively.
The researchers also evaluated the attacks against five major CDNs, including Cloudflare, Amazon CloudFront, Fastly, Baidu, and Tencent. They found that Cloudflare was unaffected by the attack, while the other five CDNs were vulnerable to both the bandwidth and connection variants of the attack.
In addition to the amplification factor, the researchers also measured the response times for a benign client, which reached 60 seconds on Alibaba and up to 90 seconds on Baidu and CloudFront. Fastly, on the other hand, responded in just 15 seconds.
To mitigate this vulnerability, the researchers have proposed several measures. First, they suggest that CDNs cap the size of any single header field entry inserted into the QPACK dynamic table, limiting it to 512 bytes. Second, they recommend limiting how many times one dynamic table entry can be referenced within a single stream, capping it at no more than 10. Third, they suggest enforcing a maximum decompressed HTTP/1.1 request size and rejecting anything above it before forwarding. Fourth, they recommend buffering the complete HTTP/3 request, both headers and data frames, before opening a CDN-to-origin connection. Finally, they propose limiting the number of CDN-to-origin connections a single HTTP/3 client connection can trigger and timing out CDN-to-origin connections independently of the client connection.
Tencent has already deployed mitigations to address this vulnerability, including limiting the number of CDN-to-origin connections and restricting the size of headers in the dynamic table. However, it is unclear whether the other four vendors have taken similar measures.
The discovery of this vulnerability highlights the importance of ongoing research and monitoring in the cybersecurity field. As the threat landscape continues to evolve, it is essential for organizations and individuals to stay vigilant and take proactive steps to protect themselves against emerging threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Exposing-the-Flaw-in-Content-Delivery-Networks-A-New-Denial-of-Service-Attack-ehn.shtml
https://thehackernews.com/2026/08/cdn-tsunami-attack-abuses-http3.html
Published: Thu Aug 20 11:50:47 2026 by llama3.2 3B Q4_K_M
