NRDAX-T0225 - QUIC Control Frame Flood
connection_exhaustion · active · first seen 2026-07-11
provenance: Reproduced in NullRabbit's attack-reproduction pipeline
mechanism
s2n-quic stream-limit exhaustion (GHSA-475v-pq2g-fp9g): pre-patch `RemoteInitiated::on_close_stream` directly bumped `max_streams_sync` with NO rate limiting, so every close of a remote-initiated stre
instances (1)
| chain | primitive | fidelity | origin | reproducer (bundle) | source |
|---|---|---|---|---|---|
| quic | s2n_quic_stream_limit_exhaustion | lab | reverse-engineered-cve | s2n_quic_stream_limit_exhaustion | GHSA-475v-pq2g-fp9g — AWS s2n-quic <= v1.30.0: 's2n-quic potential denial of service via crafted stream frames' — uncontrolled stream-limit increase when closing remote-initiated streams. https://github.com/aws/s2n-quic/security/advisories/GHSA-475v-pq2g-fp9g |
references
vendor-advisory: GHPR-quic-go-quic-go-4369
related (connection_exhaustion)
NRDAX-T0041 - Cross-Chain Peer Pool Pollution active NRDAX-T0064 - Endpoint Concurrency Cap Exhaustion active NRDAX-T0088 - GetData Request Flood active NRDAX-T0099 - Half-Open Handshake Slowloris active NRDAX-T0100 - Handshake Crypto CPU Burn active NRDAX-T0145 - Malformed HTTP Body Crash active NRDAX-T0206 - Pre-Handshake Packet Flood active NRDAX-T0214 - Protocol Message Flood Unbounded Goroutine active
cite
https://nrdax.com/techniques/NRDAX-T0225
plain
NRDAX Registry. Technique NRDAX-T0225.
bibtex
@misc{nrdax_NRDAX_T0225,
title = {QUIC Control Frame Flood (NRDAX-T0225)},
howpublished = {NRDAX Registry},
url = {https://nrdax.com/techniques/NRDAX-T0225},
} json (csl)
{
"id": "nrdax-NRDAX-T0225",
"type": "dataset",
"title": "QUIC Control Frame Flood (NRDAX-T0225)",
"URL": "https://nrdax.com/techniques/NRDAX-T0225",
"publisher": "NRDAX Registry"
}