QUIC, HTTP/3 & WebTransport Vulnerabilities - and How pqcrypta-proxy Mitigates Them

The Vulnerability → Mitigation Map

Each row is a documented issue, tagged with one or more of the Implemented Stack-avoided Bounded classes defined in “How to read the mapping” above.

0-RTT Replay (RFC 9001 §9.2)

TLS 1.3 0-RTT (and QUIC’s early data) lets a client send application data in the first flight, before the handshake completes. RFC 9001 §9.2 is explicit that this data is replayable: a network attacker can capture the early-data packet and re-send it. The consequence is that a non-idempotent request - place an order, change a password, transfer funds - can be replayed for duplicate effect, and the usual server-side defences break down in distributed / CDN deployments where the anti-replay state is not shared.

pqcrypta-proxy treats 0-RTT as opt-in and replay-guarded by construction:

# Per-route control - deny early data on anything non-idempotent
[[routes]]
path     = "/api/"
enable_0rtt = false          # route never accepts 0-RTT

# Global early-data replay guard
nonce_store_mode = "strict"  # strict | session | none
                             # strict rejects any replayed early-data nonce
                             # inside the configurable window

Two structural backstops sit behind the config. The nonce store in tls_acceptor.rs rejects a replayed early-data nonce within the window. And the startup config-conflict validator refuses to boot a configuration that enables 0-RTT on a non-safe route without replay protection, so the unsafe combination cannot be deployed. The protocol flaw is not removed, but every path that could exploit it is closed or guarded, and an unsafe config fails closed at startup.

WebTransport Attack Surface

WebTransport runs over HTTP/3 on a dedicated UDP port (4433 by default, webtransport_port configurable). Two properties raise its risk. First, it follows the same-origin policy, but the server must enforce it: the IETF WebTransport overview draft requires the server to validate the Origin of browser-initiated sessions. Second, a TCP probe of the UDP port returns connection-refused, so scanners that only test TCP report no service and skip the surface.

pqcrypta-proxy enforces origin at the session boundary (SR-02): a browser session whose Origin is not in webtransport_allowed_origins is rejected with 403; non-browser clients that send no Origin are handled under a separate rule rather than blanket-trusted. Resource exhaustion across the multiplexed channel is capped by per-origin limits - maximum sessions per origin, streams per session, and datagrams per second - so a single origin cannot exhaust the listener by opening unbounded streams or flooding datagrams.

[server]
webtransport_port = 4433
webtransport_allowed_origins = ["https://pqcrypta.com"]   # SR-02 allowlist
# per-origin caps: max sessions/origin, streams/session, datagrams/sec

Inspecting HTTP/3 Requires Terminating QUIC

Traditional IDS / IPS / DPI / inline-WAF appliances inspect reassembled TCP byte streams. QUIC encrypts the transport header, so to a network device the traffic is opaque UDP: it sees ports and nothing else. Signatures those devices carry for HTTP attacks do not fire on QUIC. Devices that cannot inspect QUIC often block UDP/443, forcing clients to fall back to HTTP/2 over TCP, which moves the attack surface to the TCP path rather than removing it.

The only place left to inspect HTTP/3 and WebTransport is the endpoint that holds the session keys. pqcrypta-proxy terminates QUIC and runs its full inspection stack on the decrypted requests: the pattern-based WAF (SQLi, XSS, traversal, NoSQLi, SSRF, command injection, XXE, deserialization - OWASP A01/A03/A08/A10), JA3/JA4 fingerprinting with replay and drift detection, and multi-dimensional rate limiting - all applied identically on TCP (H1/H2) and QUIC/HTTP3 paths. The inspection point is the proxy, not a middlebox that QUIC made blind.

Verifying the Mitigations

The mitigations above are verified on every deploy, not assumed. The pqcrypta-proxy pentest suite runs 32 automated black-box attack scripts across 12 phases on every deploy, covering WAF bypass, HTTP smuggling across HTTP/1.1, HTTP/2, HTTP/3 and WebTransport, SSRF, timing oracles, race conditions, and the QUIC/WebTransport port-isolation checks. To reproduce the core QUIC-layer checks yourself:

1. Confirm the endpoint advertises only h3 via Alt-Svc and only QUIC v1 in Version Negotiation.
2. TCP-probe the WebTransport port (4433) - expect connection refused; a TCP listener there is a misconfiguration.
3. Open a WebTransport session from an origin not on the allowlist - expect 403.
4. Force a classical-only TLS ClientHello where PQC is required - expect a 421 (or an audit-log downgrade event, per policy).
5. Send early data on a route with enable_0rtt = false - expect rejection; replay a captured early-data packet - expect the nonce store to drop it.

For the full transport-layer architecture and the QUIC-vs-TCP performance case, see the QUIC vs TCP Real-World Analysis whitepaper and the pqcrypta-proxy documentation.

Frequently Asked Questions