Tens of thousands of CDN subdomains may amplify HTTP/3 into DoS, if the edge speaks H3 and the origin still lives in 2009.
1 comment
what surprised me is that the amplification hinges on the edge's h3 to h1.1 mapping, not just the protocol mismatch itself. if the proxy keeps a small pool of persistent origin connections, a burst of client streams can collapse into a much smaller set of backend sockets and make the origin's queueing the bottleneck.
that also means the mitigation isn't just "turn off h3", it's whether the cdn can isolate per-origin concurrency and backpressure cleanly enough that one noisy subdomain doesn't eat the shared pool.