Cybersecurity researchers have disclosed two denial-of-service (DoS) attacks that exploit how major content delivery networks (CDNs) convert client-facing HTTP/3 traffic into HTTP/1.1 requests to the websites they front, amplifying a low-bandwidth request stream by up to 350x against the origin server.
The attacks, collectively named "CDN Tsunami," were evaluated against Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, and Tencent.
All six were found susceptible to the bandwidth variant and five to the connection variant, with Cloudflare unaffected by the latter because it buffers the complete request before opening a connection to the origin.
The attack requires a website hosted on one of the six providers, with HTTP/3 serving at the edge, and no configuration changes on the website's part. The paper lists HTTP/3 as enabled by default at Cloudflare and CloudFront.
However, Cloudflare's documentation describes HTTP/3 as available on all plans and provides steps to enable it, rather than stating it is enabled by default. AWS documentation gives http2 as the default HTTP version for new CloudFront distributions.
