Collected research

Racing and Fuzzing HTTP/3: Open-sourcing QuicDraw(H3)

Maor Abutbul · CyberArk

Adapts the single-packet race-condition attack to HTTP/3: because QUIC forbids IP fragmentation, every request is queued minus its final byte and all the withheld last bytes are released together in one packet, so the server begins processing them at once. Over 110 requests landed in a single packet, released as an open-source tool.

Record

Researcher

Maor Abutbul

Published by

CyberArk

Topic

HTTP

In the archive

• Collected in the 2025 research round

Related sources

• QuicDraw(H3) research tool

Tags

• race-condition
• http3
• fuzzing
• tooling
• http
• prior-art-extension
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Maor Abutbul, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.