QUIC / HTTP/3 Protocol Stack UDP 443 Handshake Flooding Remote DoS
An improper input handling defect [CWE-228] in the FortiOS WAD proxy daemon allows remote unauthenticated actors to trigger worker process crashes and CPU core saturation via malformed QUIC / HTTP/3 Initial packet tokens on UDP port 443.
Technical Root Cause Analysis
When deep SSL inspection or proxy-mode web filtering is enabled, FortiOS delegates incoming UDP port 443 traffic to the Wide Area Dispatcher (/bin/wad) daemon. The daemon implements a user-space QUIC transport protocol parser to unpack HTTP/3 streams, examine TLS 1.3 ClientHello extensions, and enforce security profiles.
When handling the QUIC Initial packet framing, the subroutine quic_parse_initial_packet parses variable-length connection IDs (DCID/SCID) and token fields. If a packet presents an invalid token length field exceeding the remaining UDP payload or containing zero-length CRYPTO frame offsets, an integer underflow occurs in the length validation logic.
This triggers an out-of-bounds read into unmapped memory addresses, generating a Linux SIGSEGV (signal 11) that immediately crashes the WAD worker. A continuous flood of crafted QUIC packets sends all assigned WAD worker threads into infinite restart loops, spiking CPU utilization across all inspection cores to 100% and terminating active TCP/SSL proxy sessions.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.2 – 7.2.6 | 7.2.7+ | Block UDP 443; disable QUIC profile |
| FortiOS 7.4 | 7.4.0 – 7.4.1 | 7.4.2+ | Block UDP 443 or upgrade firmware |
| FortiOS 7.0 | Not Affected | 7.0.x Clean | QUIC proxy parsing not implemented in 7.0 |
| FortiOS 7.6 | Not Affected | 7.6.0+ Clean | Hardened bounds validation in place |
Platform Impact: Affects desktop and mid-range FortiGate appliances (FG-60F through FG-200F) running proxy-based inspection or deep SSL inspection with HTTP/3 / QUIC enabled.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands via SSH or console to evaluate UDP port 443 session load, verify WAD worker process states, and check per-core CPU utilization:
Diagnostic Commands
# 1. Inspect firewall session statistics for UDP 443 QUIC connection counts
diagnose firewall session full-stat | grep 443
# 2. Query WAD worker processes and memory distribution
diagnose test application wad 1000
# 3. Monitor real-time multi-core CPU usage to detect worker thread saturation
diagnose sys mpstat 1Remediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
Under proxy mode, crafted QUIC Initial packets with corrupted token length fields trigger an integer underflow in quic_parse_initial_packet, causing memory segmentation faults in WAD worker threads.
No. Browsers automatically and transparently fall back to standard TCP TLS 1.3 / HTTP/2 within milliseconds when UDP 443 is rejected, preserving user connectivity without interruption.
The fix is present in FortiOS 7.2.7+, 7.4.2+, and all releases of FortiOS 7.6.x.