I-D Action: draft-rajappa-httpbis-connection-contamination-00.txt

Internet-Draft draft-rajappa-httpbis-connection-contamination-00.txt is now
available.

   Title:   Mitigating HTTP/3 Connection Contamination in Multi-Tenant and CDN-Fronted Deployments
   Author:  Madhusudhan Rajappa
   Name:    draft-rajappa-httpbis-connection-contamination-00.txt
   Pages:   13
   Dates:   2026-08-12

Abstract:

   HTTP/3 [RFC9114] clients commonly reuse ("coalesce") an existing QUIC
   [RFC9000] connection for requests to a second origin when the TLS
   certificate presented on that connection is also valid for the second
   origin, even though the two origins may route to entirely different
   backends.  This document describes "connection contamination," a
   class of security exposure that arises when a routing layer --
   reverse proxy, load balancer, or CDN edge -- determines backend
   routing using a signal established at connection setup rather than
   re-validated per request.  Under that condition, a coalesced
   connection can be used to reach an unintended backend origin,
   potentially enabling cross-tenant data leakage, authentication
   bypass, and response-queue interference analogous to HTTP request
   smuggling.

   This document defines the underlying mechanism, characterizes the
   attacker model, distinguishes connection contamination from related
   QUIC exposures, and provides normative operational guidance for
   implementers and operators of HTTP/3-terminating infrastructure.  The
   key words herein carry the meanings defined in [RFC2119] and
   [RFC8174].

The IETF datatracker status page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-rajappa-httpbis-connection-contamination/

There is also an HTMLized version available at:
https://datatracker.ietf.org/doc/html/draft-rajappa-httpbis-connection-contamination-00

Internet-Drafts are also available by rsync at:
rsync.ietf.org::internet-drafts


_______________________________________________
I-D-Announce mailing list -- [email protected]
To unsubscribe send an email to [email protected]