A QUIC flood works by opening more half-formed QUIC connections than a server can afford to set up, rather than by filling its uplink with raw bytes. It is a Layer 4 attack vector, one of the transport-layer surfaces DDoS testing has to reach now that services are moving to HTTP/3. QUIC is the UDP-based transport under HTTP/3, terminating on UDP 443, and it folds the connection handshake and the TLS 1.3 key exchange into the same first exchange. A flood aims those opening packets at the server so it spends CPU on cryptography and memory on connection state for connections that will never carry a request.
How a QUIC flood works
Like any protocol attack, it fills a finite resource a stateful endpoint keeps per connection instead of saturating the link. What is specific to QUIC is where that resource sits and how cheaply the attacker can make the server commit it.
An attacker sends a stream of QUIC Initial packets, the first packet of a new connection. Each one carries the start of a TLS 1.3 handshake, so the server parses it, derives initial keys, and allocates connection state indexed by the connection ID the client chose. That is real asymmetric-crypto work and a real memory allocation, triggered by a single small UDP datagram the attacker spent almost nothing to send. The measure of the attack is handshakes per second and connection-state memory, counted like any protocol vector in packets, not bits.
Two properties make it worse than the TCP equivalent. First, QUIC rides on UDP, so a source address can be spoofed the way it can in any UDP flood, and the stateful filtering that catches a forged TCP handshake does not apply. Second, most servers terminate QUIC in userspace rather than in the kernel, so each packet crosses into a user process to be handled, which costs more per packet than a kernel-space TCP handshake and is harder to offload to hardware.
QUIC's designers anticipated the reflection risk. RFC 9000 sets an anti-amplification limit: until it has validated the client's address, a server may not send more than three times the bytes it has received, which caps how much a spoofed Initial can bounce off the server toward a victim. That limit blunts reflection, but it does nothing for the compute a flood is really after. The server still parses the packet and still begins the handshake before it decides the address is unproven.
Why it hides on the wire
A QUIC flood barely registers as traffic. A few hundred thousand Initial packets a second is nothing on the wire yet plenty to saturate a CPU grinding through handshakes, so the resource that runs out is CPU time and connection-state memory while HTTP/3 requests quietly time out. Link utilization, the number most teams alert on, stays calm throughout.
It is also a surface older mitigations were never tuned for. A scrubbing profile written for TCP SYN floods and UDP amplification can pass QUIC Initials straight through, because on the wire they look like ordinary small UDP packets aimed at UDP 443. As HTTP/3 adoption grows across the major CDNs, that gap widens: the same edge that has absorbed L4 floods for years can carry an untested compute ceiling on the newest transport it terminates.
What a DDoS test measures
A QUIC flood test characterizes the handshake ceiling: how many Initial packets per second the edge processes before CPU saturates and real HTTP/3 clients are refused. That number, not a bandwidth figure, is the resilience result for this vector.
It then confirms the specific defenses fire. Does the server issue a Retry packet, handing the client a token it must echo before any state is allocated, so an unvalidated or spoofed source never reaches the expensive handshake? That is the QUIC analogue of SYN cookies: answer cheaply first, commit resources only once the address is proven. Does address validation actually engage under load rather than only in a lab, and does the edge apply per-source connection-rate limits before the crypto runs rather than after?
How providers terminate and absorb edge transport floods like this is compared in AWS Shield vs Cloudflare DDoS Protection.