CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification
- ID
- 16032
- Status
- summarized
- Published
- 20 Aug 2026, 7:39 PM
- Fetched
- 20 Aug 2026, 9:35 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/cdn-tsunami-attack-abuses-http3.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 7.0
- Created
- 20 Aug 2026, 9:38 PM
- Tags
- Audience
- developerssaas_founders
What happened
Researchers disclosed 'CDN Tsunami,' two DoS attack techniques (HBA and HCA) that exploit how CDNs translate HTTP/3 client traffic into HTTP/1.1 requests to origin servers, achieving up to 350x bandwidth amplification on Alibaba/Baidu/Tencent and 36-51x on Cloudflare, CloudFront, and Fastly. All six tested CDNs were vulnerable to the bandwidth variant; Cloudflare alone was unaffected by the connection variant because it buffers the full request before connecting to origin. Baidu and Tencent confirmed and deployed fixes; no CVEs have been assigned and no in-the-wild exploitation is reported.
Why it matters
If your site sits behind Cloudflare, CloudFront, or Fastly with HTTP/3 at the edge, your origin server can be hit with 36-51x amplified traffic from a low-bandwidth attacker, and you cannot fix this at the origin — only the CDN can. Check whether your CDN provider has deployed mitigations and consider whether HTTP/3 at the edge is worth the exposure until patches roll out broadly.
Discussion angle
Since mitigations are CDN-side only, what should a small team on Cloudflare or CloudFront do right now — disable HTTP/3 at the edge as a precaution, or trust the provider to patch, and how do you even verify a fix has been applied?