WAF Bypass

Google Cloud Armor Security Flaw Allows WAF Rule Bypass via HTTP/3 and QUIC Stream Desynchronization (CVE-2026-79510)

Google patches a high-severity desynchronization flaw in Cloud Armor edge proxies that allowed attackers to smuggle malicious HTTP/3 payloads past WAF rules.