BlueHat IL 2026 - Maor Abutbul - Why-So-QUIC!? Racing and Fuzzing HTTP/3 WebApps using QuicDraw-UI
Engineers explore architecture and security mechanisms for BlueHat IL 2026 - Maor Abutbul - Why-So-QUIC!? Racing and Fuzzing HTTP/3 WebApps using QuicDraw-UI.
Summary
Overview: Maor Abutbul of CyberArk presents at BlueHat IL 2026 on fuzzing and racing HTTP/3 web applications using QuicDraw-UI, addressing the security research gap around QUIC protocols.
Key Topics: HTTP/3 adoption reaching nearly 40% of internet-facing sites; QUIC over UDP with mandatory encryption; differences from HTTP/2 including connection migration; and limited HTTP/3 security research availability.
Technical Details: Abutbul introduces QuicDraw-UI for fuzzing HTTP/3 applications, explaining how QUIC's UDP transport, binary framing, and built-in TLS change the attack surface compared to TCP-based HTTP/2.
Takeaways: HTTP/3 is widely deployed but understudied from a security perspective. Researchers and defenders should prioritize QUIC-aware testing tools and protocol-specific race conditions.
Related talks
Microsoft Israel R&D Center·32 min
Maor Abutbul
Analysts investigate attack surfaces and defenses concerning BlueHat IL 2025 - Maor Abutbul - Let's be Authentik: Your identity is Mine.
CSIT Village·22 min
Poh Cai Min · Shawn Pang
Poh Cai Min and Shawn Pang examines grammar-based fuzzing made painless.
Briefings·34 min
Ryan Barnett · Isabella Barnett
As web applications evolve, so do their data processing pipelines—handling Unicode normalization, encoding, and translation before storing or executing user input.