QUIC-er Races: HTTP/3 won’t save you from TOCTOU vulnerabilities

Abstract Race conditions in web applications represent a persistent class of vulnerabilities that allow adversaries to bypass business logic through synchronized request bursts. While the transition from TCP-based HTTP/2 to UDP-based HTTP/3 (QUIC) introduces stochastic processing delays and independent stream delivery, the security implications of these protocol shifts remain under-explored. This work investigates the effectiveness of race condition exploits across modern transport protocols. Our experimental results demonstrate that while the user-space implementation of QUIC provides a resilience threshold against low-volume attacks, this protection is an artifact of scheduling jitter and is inherently fragile. We identify a critical concurrency threshold ( $$N=100$$ N = 100 ) where the density of a Single Datagram Attack (SDA) saturates the protocol parser, achieving an exploitation efficiency ( f ) that exceeds traditional HTTP/2 methods. However, we also identify a “smothering effect” unique to high-density bursts, where extreme transaction arrival rates trigger database-level lost updates that can paradoxically limit total economic impact. Furthermore, we show that infrastructure-level defenses, such as network pacing, are effectively neutralized by the reverse proxy’s de-multiplexing process. We conclude that protocol-level evolution does not mitigate application-layer concurrency risks; rather, it shifts the attack surface dynamics toward more efficient but higher-contention exploitation primitives.