CDN-Security

Sending an RFC 9114 §4.1 trailer HEADERS frame to production HTTP/3 infrastructure triggers state machine failures across two independent CDN edge implementations and the quiche client library. Server-side: 60-second goroutine hang (CDN-A) and 12,200ms QPACK decoder stall with 24.9× worker amplification (CDN-B). Client-side: permanent zombie stream leak in quiche driving Network Service memory from 6 MB to 339 MB before OOM. All three share the same root cause: the second HEADERS frame on a request stream reaches a code path with no defined handler. The threat model inversion — server pushing a malformed trailer toward client — transforms a server-side bug class into a drive-by browser memory exhaustion attack.

A second HEADERS frame (RFC 9114 §4.1 trailer) on a YouTube ESF request stream causes a ~60-second server-side hang followed by QUIC INTERNAL_ERROR 0x0001, indicating an unhandled exception in ESF’s HTTP/3 state machine. The crash bypasses HTTP-layer rate limiting and WAF controls architecturally — the connection terminates at the transport layer before any HTTP request object is created. Confirmed deterministically across 3/3 runs. Google VRP declined to track as a security issue. Full PoC and cross-vendor evidence included.