---
title: "HTTP/3 Race Fuzzer"
canonical: https://trickest.com/library/http-3-race-fuzzer
description: "Compare QuicDraw baseline GET vs concurrent HTTP/3 race traffic, then correlate race evidence you can retest."
---

# HTTP/3 Race Fuzzer

## Overview

HTTP/3 (QUIC) race bugs show up as stream and body deltas under concurrent load that a single GET never surfaces. Operators need a baseline versus race fan-out, plus a retest delta when the QUIC stack or app changes.

This is a standing check for [continuous security testing](/use-cases/continuous-security-testing). You set an HTTPS/h3 URL, run BHUSA 2026 Arsenal QuicDraw once as a baseline GET and once with concurrent race (`-tr`), diff the two, and correlate findings. Demo default is `cloudflare-quic.com`.

It sits next to transport-facing appsec graphs such as [SSRF Scanner](/library/ssrf-scanner). This Collection unit is the QuicDraw race path: edit Seed; both scanners read `url-file` (leave the `url` string empty).

## Pipeline

1. Seed · HTTP/3 target URL(s) supplies the demo or BYO HTTPS/h3 inventory.
2. Build · URL inventory normalizes that list for both scan legs.
3. Scan · QuicDraw baseline GET runs the control probe.
4. Scan · QuicDraw race (`-tr 12`) runs the concurrent Quic-Fin-Sync race.
5. Compare · Baseline vs race diffs stream and body evidence.
6. Results · Evidence report emits findings, inventory, remediation, and retest_delta outputs.

## Inputs

- **HTTP/3 target URL(s).** Demo default `https://cloudflare-quic.com/`. Edit Seed; both scanners read that file via `url-file`.
- **Race concurrency.** Default `-tr 12` on the race leg. Raise it on **Scan · QuicDraw race**.
- **Optional fuzz wordlist.** Mount when you mean to drive additional race inputs.

## Outputs

- **findings.jsonl.** Race evidence rows with remediation hints.
- **inventory.jsonl.** URLs and stream observations.
- **retest_delta.jsonl.** Schedule-as-diff scaffold when the QUIC or app stack changes.

## Integrations

- [QuicDraw](/tools/quicdraw) (BHUSA 2026 Arsenal)

## Sample output

Sample shape from the report pack on the demo URL (illustrative, not a live KPI).

```jsonl
{"kind":"finding","title":"Baseline vs race stream or body delta","severity":"medium"}
{"kind":"inventory","note":"HTTP/3 URL observed in baseline and race legs"}
{"kind":"retest_delta","note":"Schedule re-runs after QUIC or app changes"}
```

## FAQ

### Do I need a special client beyond QuicDraw?

No. Both legs are QuicDraw nodes on the graph. Edit Seed; they read `url-file`. Leave the `url` string empty.

### Is the demo URL safe to leave as default?

`cloudflare-quic.com` is the public QuicDraw demo target for smoke. Replace it before you treat results as yours.

### Why schedule this?

The report emits `retest_delta.jsonl` so scheduled re-runs can surface race posture change after stack upgrades.

## Related workflows

- [SSRF Scanner](/library/ssrf-scanner). Reach for this instead when the job is server-side request abuse, not QUIC race fan-out.
- [PQ Crypto Surface Scanner](/library/pq-crypto-surface-scanner). Reach for this instead when the job is TLS/PQC inventory, not HTTP/3 race evidence.

---
_Markdown source of https://trickest.com/library/http-3-race-fuzzer._