The edge tier you rent is the attack surface: 42,330 subdomains, no published multiplier

The figure to lead with is not 350x. The paper text in hand describes the amplification mechanism and counts the exposure, but it does not attach a numeric multiplier to either attack ^[13]. What it does ground is 42,330: the count of subdomains in the Tranco Top 1M that the authors flag as potentially vulnerable after a large-scale measurement ^[4].

The mechanism is a protocol seam, not a bug in either protocol. When the CDN speaks HTTP/3 to clients but the origin still speaks HTTP/1.1, an attacker sends a small amount of efficient HTTP/3 traffic to the edge and the edge converts it into a large amount of inefficient HTTP/1.1 traffic aimed at the origin ^[1]. Two variants: HTTP/3 Bandwidth Amplification abuses QPACK, where compact index values decode into full raw HTTP headers on the origin side ^[2]; HTTP/3 Connection Amplification drip-feeds DATA frames to control how long the CDN-to-origin connection stays open, exhausting the origin's connection pool ^[3].

That is a rented-tier problem. Over 55 percent of the Top 10K and more than 40 percent of the Top 1M sit behind CDNs ^[6], and HTTP/3 is standardised in RFC 9114 and RFC 9204 and supported by most CDN services and 35.2 percent of websites ^[7]. The disparity that makes the attack work is asymmetric adoption: the edge upgraded, the origin did not ^[1]. Earlier CDN amplification work, including the HTTP/2-to-HTTP/1.1 conversion attack, is largely known and already defended against ^[8], which is why the new seam matters.

The same rented-tier logic appears one layer up. Cloudflare Workers packs tens of thousands of tenants into a single OS process using V8 isolates ^[9], where one arbitrary read inside a Worker process can leak across tenants ^[12]. Cloudflare's own researchers demonstrated a remote Spectre attack leaking up to 12 bit/s at 99 percent accuracy in production ^[10], now mitigated with no evidence of exploitation in three years ^[11].