Google Cloud Armor Security Flaw Allows WAF Rule Bypass via HTTP/3 and QUIC Stream Desynchronization (CVE-2026-79510)

Executive Summary

Google Cloud security engineering has disclosed and resolved CVE-2026-79510, a high-severity request desynchronization flaw impacting Google Cloud Armor edge security policies when inspecting web traffic delivered over HTTP/3 (QUIC) transport.

Cloud Armor provides enterprise Distributed Denial of Service (DDoS) mitigation and Web Application Firewall (WAF) filtering at Google's global network edge. The vulnerability allowed threat actors to craft anomalous HTTP/3 stream sequences that bypassed pre-configured WAF core rule sets (such as OWASP ModSecurity Core Rule Set evaluations) while being fully accepted and executed by upstream backend workloads hosted on Google Kubernetes Engine (GKE) and Cloud Run.

Root Cause: Discrepancy in QUIC Frame Boundary Handling

Unlike HTTP/1.1 and HTTP/2, which rely on single TCP streams, HTTP/3 utilizes independent QUIC streams multiplexed over UDP. The flaw manifested when edge inspection proxies parsed fragmented HEADERS and DATA frames with non-standard trailing pseudo-headers.

When an attacker sent a zero-length DATA frame followed by split pseudo-headers containing secondary URI query parameters, Cloud Armor's edge parser marked the stream as benign and terminated inspection. However, the downstream Google Cloud HTTP(S) Load Balancer re-assembled the subsequent chunks into a single concatenated request, executing previously masked SQL injection or path traversal strings against backend applications.

Exploitation Walkthrough

The attack leverages HTTP/3 request smuggling:

1. Stream Initiation: The adversary initiates an encrypted QUIC session to the Cloud Armor VIP on port 443/UDP.
2. Header Fragmentation: The payload is segmented across non-contiguous HEADERS frames where the malicious parameter (e.g., UNION SELECT or ../etc/passwd) appears after an artificially padded header list.
3. Edge Pass-Through: Cloud Armor evaluates the first chunk, verifies it as compliant with CRS v3.3, and signals approval.
4. Upstream Recombination: The internal proxy forwards the complete buffered payload to the target container, where the uninspected payload triggers application-level exploitation.

Mitigation & Enterprise Verification Actions

While Google has rolled out global edge patches mitigating the deserialization anomaly, enterprise cloud security architects should perform the following validation checks:

• Review Cloud Armor Request Logs: Query Cloud Logging for HTTP/3 requests exhibiting irregular QUIC stream reset flags (HTTP/3 STREAM_RESET_ERROR) or anomalous header lengths.
• Defense in Depth: Ensure backend applications continue to enforce strict parameterized database queries and input validation rather than treating perimeter WAFs as the sole defense layer.
• Enable Cloud Armor Adaptive Protection: Activate ML-based anomaly detection to capture recurring behavioral patterns that deviate from standard web client traffic.