HTTP/3-to-HTTP/1.1 Translation Turns CDNs Into 350x DoS Amplifiers
New research dubbed CDN Tsunami shows that when a CDN speaks HTTP/3 to browsers but HTTP/1.1 to origin sites, attackers can amplify a sub-500 Kbps request stream into 100+ Mbps of origin-bound traffic, up to 350x. The two techniques, bandwidth (HBA) and connection (HCA) amplification, hit all six major CDNs tested; Cloudflare dodged only HCA, and 42,330 Tranco Top-1M subdomains look vulnerable. Two vendors have already patched with bounties. No CVEs or in-the-wild exploits yet.