QUIC action: patching a broadcast address amplification vulnerability
Feb 10, 2025Josephine Chow, June Slater, Bryton Herdes, Lucas Pardue
Summary
This post details the discovery and mitigation of a broadcast address amplification vulnerability in Cloudflare's QUIC implementation. It explains how sending a QUIC Initial packet to a broadcast IP address could trigger a server CPU and reflection amplification attack. The vulnerability was traced to the way Cloudflare servers bind anycast IP ranges to their loopback interfaces, creating local and broadcast routes that, when targeted by a QUIC Initial packet to a broadcast address, could lead to excessive response packets. The fix involved modifying the server's packet handling logic to prevent this amplification vector.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack