# Cache Poisoning DoS on updates.rockstargames.com

Unkeyed `trailer` header caused CDN cache to store 400 responses on updates.rockstargames.com, denying legitimate users access to patch notes.

- Payout: hidden
- Severity: medium
- Program: Rockstar Games
- Found by: youstin
- Disclosed: 2021-12-22
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1219038
- Library page: https://bugbountylibrary.com/r/h1%3A1219038
- Tags: area:web domain:web impact:dos kind:bounty platform:hackerone sev:medium technique:recon vuln:cache-poisoning vuln:dos

**Target:** CDN-fronted static file host updates.rockstargames.com
**Root cause:** CDN cache key omitted the `trailer` request header, so a request with `trailer: 1` produced a 400 response that was cached and served to all users.
**Steps:**
1. Send `GET /patches/gtaiv/notes_title_update_6/GTAIVPC_TU6_Patch_Notes_FR.txt?donotpoisoneveryone=1 HTTP/1.1` with `Host: updates.rockstargames.com` and header `trailer: 1`
2. Observe origin/CDN returns 400
3. Confirm the 400 is cached and served to subsequent legitimate requests for the same path
**How found:** Researcher explored cache poisoning at scale by testing unkeyed headers (e.g. `trailer`) against CDN-fronted hosts and observing that a malformed 400 response got cached.
**Exploitation:** Attacker sends a single request with the unkeyed `trailer: 1` header to poison the cached response for a static file path; subsequent legitimate users receive the cached 400 and are denied access.
**Insight:** Test obscure hop-by-hop/HTTP headers like `trailer` as unkeyed cache inputs; a header that triggers a 400 at the edge can be cached and weaponized as DoS even without reflected content.