Scholarlink

<p>Race conditions in web applications represent a persistent class of vulnerabilities that allow adversaries to bypass business logic through synchronized request bursts. While the transition from TCP-based HTTP/2 to UDP-based HTTP/3 (QUIC) introduces stochastic processing delays and independent stream delivery, the security implications of these protocol shifts remain under-explored. This work investigates the effectiveness of race condition exploits across modern transport protocols. Our experimental results demonstrate that while the user-space implementation of QUIC provides a resilience threshold against low-volume attacks, this protection is an artifact of scheduling jitter and is inherently fragile. We identify a critical concurrency threshold (<InlineEquation ID="IEq1"> <EquationSource Format="TEX">\(N=100\)</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mi>N</mi> <mo>=</mo> <mn>100</mn> </mrow> </math></EquationSource> </InlineEquation>) where the density of a Single Datagram Attack (SDA) saturates the protocol parser, achieving an exploitation efficiency (<i>f</i>) that exceeds traditional HTTP/2 methods. However, we also identify a “smothering effect” unique to high-density bursts, where extreme transaction arrival rates trigger database-level lost updates that can paradoxically limit total economic impact. Furthermore, we show that infrastructure-level defenses, such as network pacing, are effectively neutralized by the reverse proxy’s de-multiplexing process. We conclude that protocol-level evolution does not mitigate application-layer concurrency risks; rather, it shifts the attack surface dynamics toward more efficient but higher-contention exploitation primitives.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

QUIC-er Races: HTTP/3 won’t save you from TOCTOU vulnerabilities

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年4月24日

查看全文
  • Mohammad Amin Nasiri,
  • Efstratios Chatzoglou,
  • Georgios Kambourakis

摘要

Race conditions in web applications represent a persistent class of vulnerabilities that allow adversaries to bypass business logic through synchronized request bursts. While the transition from TCP-based HTTP/2 to UDP-based HTTP/3 (QUIC) introduces stochastic processing delays and independent stream delivery, the security implications of these protocol shifts remain under-explored. This work investigates the effectiveness of race condition exploits across modern transport protocols. Our experimental results demonstrate that while the user-space implementation of QUIC provides a resilience threshold against low-volume attacks, this protection is an artifact of scheduling jitter and is inherently fragile. We identify a critical concurrency threshold ( \(N=100\) N = 100 ) where the density of a Single Datagram Attack (SDA) saturates the protocol parser, achieving an exploitation efficiency (f) that exceeds traditional HTTP/2 methods. However, we also identify a “smothering effect” unique to high-density bursts, where extreme transaction arrival rates trigger database-level lost updates that can paradoxically limit total economic impact. Furthermore, we show that infrastructure-level defenses, such as network pacing, are effectively neutralized by the reverse proxy’s de-multiplexing process. We conclude that protocol-level evolution does not mitigate application-layer concurrency risks; rather, it shifts the attack surface dynamics toward more efficient but higher-contention exploitation primitives.