Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

CDN Tsunami HTTP/3 translation DoS amplification analysis across major CDNs

Technical Analysis
First reported
Last updated
Happening score
H score 23
1 unique sources, 1 articles

Summary

Hide ▲

Researchers disclosed CDN Tsunami, a DoS analysis showing that HTTP/3-to-HTTP/1.1 translation in major CDNs can amplify small request streams and overload origin resources. The study identified HBA and HCA across Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, and Tencent, with bandwidth amplification reaching up to 350x and backend connection pressure severe enough to disrupt normal service. The findings expose a deployment gap at the CDN edge where browser-facing HTTP/3 still maps to origin-facing HTTP/1.1.

Related Happenings

Popa botnet forcing consumer TV boxes to relay traffic

Malware Activity
H score76 First: 18.06.2026 20:37 Last: 18.06.2026 20:37 Sources 1

About this happening: Popa is an Android botnet that forces consumer TV boxes and related devices into relay infrastructure, maintaining encrypted connectivity and opening tunnels on demand...

Latest development: 03.07.2026 12:35

Google disabled NetNut accounts used for malware command-and-control, updated Google Play Protect to warn Android users, and disabled apps containing compromised SDKs while FBI legal actions and domain seizures targeted NetNut infrastructure. The coordinated disruption was described as degrading NetNut’s proxy network and shrinking the pool of devices available to the operator.

Open Happening

Nginx security patch release for CVE-2026-49975

Security Patch Release
H score42 First: 03.06.2026 22:08 Last: 03.06.2026 22:08 Sources 1

About this happening: Vendors released fixes for the HTTP/2 Bomb DoS issue, closing a path that could let a single client exhaust server memory within seconds. The patch set covers nginx 1.29...

Open Happening

HTTP/2 servers HPACK flow-control DoS denial-of-service flaw (CVE-2026-49975)

Vulnerability
H score26 First: 03.06.2026 22:08 Last: 03.06.2026 22:08 Sources 1

About this happening: HTTP/2 servers were found vulnerable to the HTTP/2 Bomb DoS weakness, where HPACK compression amplification plus HTTP/2 flow-control stalling lets a single client...

Open Happening

Major web servers HTTP/2 Bomb remote DoS denial-of-service flaw

Vulnerability
H score39 First: 03.06.2026 11:33 Last: 03.06.2026 11:33 Sources 1

About this happening: Researchers disclosed HTTP/2 Bomb, a remote denial-of-service vulnerability in default HTTP/2 configurations that can make NGINX, Apache HTTPD, Microsoft IIS, Envoy,...

Open Happening

NGINX and Apache HTTPD HTTP/2 Bomb mitigations

Advisory/Mitigation
H score46 First: 03.06.2026 11:33 Last: 03.06.2026 11:33 Sources 1

About this happening: Calif issued mitigation guidance for NGINX and Apache HTTPD operators after HTTP/2 Bomb was found to enable a remote denial-of-service against default HTTP/2 confi...

Open Happening

Timeline

  1. 20.08.2026 14:39 2 articles · 3h ago

    CDN Tsunami exploits HTTP/3-to-HTTP/1.1 translation for DoS amplification

    Technical Analysis Update

    Researchers disclosed CDN Tsunami, a pair of DoS techniques that exploit a deployment gap where a CDN speaks HTTP/3 to the browser but HTTP/1.1 to the website behind it, letting low-bandwidth requests amplify load against origin servers by up to 350x. The study evaluated Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, and Tencent, found all six susceptible to the bandwidth variant and five to the connection variant, and said Baidu and Tencent confirmed the reports and deployed CDN-side mitigations while no exploitation in the wild was reported.

    Show sources
    Open in new tab