HTTP/3 Race Fuzzer

Overview

HTTP/3 (QUIC) race bugs show up as stream and body deltas under concurrent load that a single GET never surfaces. Operators need a baseline versus race fan-out, plus a retest delta when the QUIC stack or app changes.

This is a standing check for continuous security testing. You set an HTTPS/h3 URL, run BHUSA 2026 Arsenal QuicDraw once as a baseline GET and once with concurrent race (-tr), diff the two, and correlate findings. Demo default is cloudflare-quic.com.

It sits next to transport-facing appsec graphs such as SSRF Scanner. This Collection unit is the QuicDraw race path: edit Seed; both scanners read url-file (leave the url string empty).

Pipeline

1. Seed · HTTP/3 target URL(s) supplies the demo or BYO HTTPS/h3 inventory.
2. Build · URL inventory normalizes that list for both scan legs.
3. Scan · QuicDraw baseline GET runs the control probe.
4. Scan · QuicDraw race (-tr 12) runs the concurrent Quic-Fin-Sync race.
5. Compare · Baseline vs race diffs stream and body evidence.
6. Results · Evidence report emits findings, inventory, remediation, and retest_delta outputs.

Inputs

• HTTP/3 target URL(s). Demo default https://cloudflare-quic.com/. Edit Seed; both scanners read that file via url-file.
• Race concurrency. Default -tr 12 on the race leg. Raise it on Scan · QuicDraw race.
• Optional fuzz wordlist. Mount when you mean to drive additional race inputs.

Outputs

• findings.jsonl. Race evidence rows with remediation hints.
• inventory.jsonl. URLs and stream observations.
• retest_delta.jsonl. Schedule-as-diff scaffold when the QUIC or app stack changes.

Integrations

• QuicDraw (BHUSA 2026 Arsenal)

Sample output

Sample shape from the report pack on the demo URL (illustrative, not a live KPI).

kind	title	severity	note
finding	Baseline vs race stream or body delta	medium	null
inventory	null	null	HTTP/3 URL observed in baseline and race legs
retest_delta	null	null	Schedule re-runs after QUIC or app changes

FAQ

Do I need a special client beyond QuicDraw?

No. Both legs are QuicDraw nodes on the graph. Edit Seed; they read url-file. Leave the url string empty.

Is the demo URL safe to leave as default?

cloudflare-quic.com is the public QuicDraw demo target for smoke. Replace it before you treat results as yours.

Why schedule this?

The report emits retest_delta.jsonl so scheduled re-runs can surface race posture change after stack upgrades.

Related workflows

• SSRF Scanner. Reach for this instead when the job is server-side request abuse, not QUIC race fan-out.
• PQ Crypto Surface Scanner. Reach for this instead when the job is TLS/PQC inventory, not HTTP/3 race evidence.