Network-Security

Sending an RFC 9114 §4.1 trailer HEADERS frame to production HTTP/3 infrastructure triggers state machine failures across two independent CDN edge implementations and the quiche client library. Server-side: 60-second goroutine hang (CDN-A) and 12,200ms QPACK decoder stall with 24.9× worker amplification (CDN-B). Client-side: permanent zombie stream leak in quiche driving Network Service memory from 6 MB to 339 MB before OOM. All three share the same root cause: the second HEADERS frame on a request stream reaches a code path with no defined handler. The threat model inversion — server pushing a malformed trailer toward client — transforms a server-side bug class into a drive-by browser memory exhaustion attack.

A malformed trailer HEADERS frame (END_STREAM=0) on a WebTransport CONNECT stream leaves quiche’s stream state machine permanently stuck: trailers_decompressed_=true but fin_received()=false, causing IsDoneReading() to return false forever. The stream is never removed from stream_map_, ShouldKeepConnectionAlive() holds the QUIC connection open, and Edge sends PING keepalives every ~15s indefinitely. A single webpage can open thousands of these zombie connections with no server-side limit, exhausting Network Service memory and crashing the browser. Both MSRC and Chrome VRP declined to track as security issues.

A second HEADERS frame (RFC 9114 §4.1 trailer) on a YouTube ESF request stream causes a ~60-second server-side hang followed by QUIC INTERNAL_ERROR 0x0001, indicating an unhandled exception in ESF’s HTTP/3 state machine. The crash bypasses HTTP-layer rate limiting and WAF controls architecturally — the connection terminates at the transport layer before any HTTP request object is created. Confirmed deterministically across 3/3 runs. Google VRP declined to track as a security issue. Full PoC and cross-vendor evidence included.

uRPF performs reverse routing lookup on every incoming packet’s source address — if the packet arrived on the wrong interface, it’s spoofed and dropped. When uRPF is disabled (the enterprise wireless default due to asymmetric routing), any host on the L2 segment can claim any source IP unconditionally. This is CWE-290 at Layer 3. Three confirmed attack classes in ArubaOS AOS-8: Smurf amplification (spoofed src → broadcast → victim flood), ICMP Timestamp leak (impersonate trusted management IP → elicit timestamp response), pre-auth reflection (use controller as intermediary). Single-packet pcap signature included. Linux sysctl and Cisco IOS uRPF configuration provided.

EtherLeak is an ICMP information disclosure class that resurfaces across vendors and decades — same root cause, different hardware. IP stacks that trust IP_Total_Length over actual frame length expose NIC DMA ring buffer contents via ICMP Echo. Combined with TTL=0, extraction runs at 1,800 bytes/second with zero IDS alerts, zero firewall logs. Covers full mechanism, threshold math, Suricata detection rules, and Scapy PoC.

Smurf amplification requires three weaknesses simultaneously: no uRPF allows IP source spoofing, directed broadcast forwarding delivers the packet to all VLAN hosts, hosts reply to broadcast ICMP Echo. RFC 2644 fixed router-level directed broadcast. L2 broadcast domains are unaffected — the packet never crosses a router. Enterprise wireless VLANs with 50-100 APs and controllers become 50-100x amplifiers. ICMP processing is pre-authentication: no credentials, no session. Two-machine verification: attacker sends spoofed src=victim to broadcast, victim captures unsolicited Echo Replies. pcap-level proof included.