NRDAX-T0099 - Half-Open Handshake Slowloris
connection_exhaustion · active · first seen 2026-07-01
provenance: Reproduced in NullRabbit's attack-reproduction pipeline
mechanism
IC quic_transport half-open QUIC handshake memory pin (IC_QUIC_HALFOPEN_PIN): a burst of QUIC v1 Initial packets (distinct SCID each) whose CRYPTO frame declares a large TLS handshake length (4096) bu
research
In-depth write-ups of this attack on nullrabbit.ai.
instances (5)
| chain | primitive | fidelity | origin | reproducer (bundle) | source |
|---|---|---|---|---|---|
| ic | ic_quic_halfopen_pin | lab | NullRabbit Labs | ic_quic_halfopen_pin | github.com ↗ |
| iota | iota_http_tls_halfopen_plaintext_grpc | lab | NullRabbit Labs | iota_http_tls_halfopen_plaintext_grpc | github.com ↗ |
| solana | sol_tpu_quic_handshake_flood | lab | reverse-engineered-cve | sol_tpu_quic_handshake_flood | neodyme.io ↗ |
| solana | sol_tpu_quic_slowloris | lab | reverse-engineered-cve | sol_tpu_quic_slowloris | neodyme.io ↗ |
| xrp | rippled_tls_slow_handshake | lab | NullRabbit Labs | rippled_tls_slow_handshake | github.com ↗ |
related (connection_exhaustion)
NRDAX-T0041 - Cross-Chain Peer Pool Pollution active NRDAX-T0064 - Endpoint Concurrency Cap Exhaustion active NRDAX-T0088 - GetData Request Flood active NRDAX-T0100 - Handshake Crypto CPU Burn active NRDAX-T0145 - Malformed HTTP Body Crash active NRDAX-T0206 - Pre-Handshake Packet Flood active NRDAX-T0214 - Protocol Message Flood Unbounded Goroutine active NRDAX-T0225 - QUIC Control Frame Flood active
cite
https://nrdax.com/techniques/NRDAX-T0099
plain
NRDAX Registry. Technique NRDAX-T0099.
bibtex
@misc{nrdax_NRDAX_T0099,
title = {Half-Open Handshake Slowloris (NRDAX-T0099)},
howpublished = {NRDAX Registry},
url = {https://nrdax.com/techniques/NRDAX-T0099},
} json (csl)
{
"id": "nrdax-NRDAX-T0099",
"type": "dataset",
"title": "Half-Open Handshake Slowloris (NRDAX-T0099)",
"URL": "https://nrdax.com/techniques/NRDAX-T0099",
"publisher": "NRDAX Registry"
}