nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Child Item

TECHNICAL BUG REPORT: SSL/TLS Interception Failure on HTTP/3 (QUIC) Protocol causing loop CAPTCHAs (Escalate to Tier 2 / Dev Team)

lowlevel

Dear Support Team,
IMPORTANT: PLEASE ESCALATE THIS TICKET DIRECTLY TO YOUR SOFTWARE ENGINEERING / DEVELOPMENT TEAM (TIER 2 SUPPORT).
I am writing to provide an important update and report a severe bug in the SSL/TLS interception engine of Bitdefender Total Security 2026 on Windows 10 IoT Enterprise 2021.

THE ISSUE
When the "Encrypted web scan" (Scansione web cifrata) option is enabled under the "Online Threat Prevention" panel, web servers continuously prompt me with loop CAPTCHAs, making standard web browsing completely impossible.

TECHNICAL FINDINGS & ISOLATION TESTS
To isolate the root cause, I conducted several cross-platform network tests:

Browser Behavior (Firefox & Chrome): The issue occurs identically on both Mozilla Firefox (v156.0) and the latest version of Google Chrome. It is not a browser-specific certificate store issue.
The HTTP/3 (QUIC) Conflict: The issue stops instantly if I perform either of these two actions:
Disable "Encrypted web scan" in Bitdefender.
Manually force-disable the HTTP/3 protocol (QUIC) inside the browser settings (e.g., setting network.http.http3.enable to false in Firefox, or using --disable-quic in Chrome).
cURL Command Line Test (HTTP/1.1): Running curl.exe -I https://google.com via PowerShell works perfectly and returns a clean HTTP 301 response over standard TCP.

System Environment Verification: To rule out any OS corruption or registry conflicts, I restored 3 different clean system backups, but the bug returned immediately every time Bitdefender's encrypted scan was active.
Local Network Isolation: Other devices connected to the same home router and network experience absolutely zero issues. This includes a smartphone connected via Wi-Fi and a Xiaomi TV Box streaming Netflix and Prime Video. This confirms that my router, ISP, and local network infrastructure are completely stable and clean.

TECHNICAL CONCLUSION (FOR DEVELOPERS)

This data clearly demonstrates that Bitdefender’s network filtering hook fails to properly handle or parse encrypted HTTP/3 (QUIC) traffic over UDP. This traffic alteration causes remote security systems (like Cloudflare or Google) to flag the requests as automated/malicious bot traffic, triggering endless CAPTCHAs. Furthermore, Bitdefender is failing to force a clean fallback (downgrade) to HTTP/2 over TCP when QUIC filtering fails.
Please forward these technical details to your Product Developers so they can release a hotfix in the next software update.
Kind regards.

Low

Find more posts tagged with

Comments

lowlevel

IMPORTANT ADDITIONAL TIMING INFORMATION

I would like to add one further detail that may be relevant to the investigation: the CAPTCHA loop was not present initially and appeared spontaneously approximately two days after Bitdefender Total Security 2026 was updated to a new product build, around September 14, 2026.

To clarify, I am referring specifically to a product engine/build update, not merely to a standard antivirus signature update.

This timing may be relevant when investigating whether a change introduced in the new build, particularly within the web traffic scanning/interception component, could be related to the behavior observed with HTTP/3 (QUIC).

I therefore ask the Tier 2 / Development team to review, if possible, the product update history and any changes made to the Encrypted Web Scan and HTTP/3/QUIC handling components in the relevant build.

Kind regards.
Low

lowlevel

UPDATE: I extracted the JA4 fingerprint using the TLS Peet diagnostics tool (https://tls.peet.ws) during the interception, and the value is:t13d1515h2_8daaf6152771_a54fffd0eb61As you can see, while the cipher hash (8daaf6152771) matches a standard Chromium structure, the extension hash (a54fffd0eb61) is heavily mutated by Bitdefender's active interception engine. This specific structural asymmetry triggers Cloudflare's and Google's anti-bot heuristics instantly, as the TLS Client Hello handshake no longer matches a legitimate browser profile.

Kind regards.

Low

Alexandru_BD

Hello and thanks for sharing your feedback here.

May I kindly ask you to raise a ticket for the Bitdefender Support teams and include the information you've provided here, or refer to this thread? This way they can escalate your findings to the development teams along with a ticket number for better tracking.

You can reach them using the link below:

https://www.bitdefender.com/consumer/support/help/

State your contact reason, choose request category, then select from the available contact channels, chat, phone and email/ticket. Chat would be the fastest way to reach them.

Let us know how it goes and feel free to share the outcome here as well.

Regards

lowlevel

Thank you very much for your kind reply and guidance.Please note that I had already raised a support ticket regarding this issue. Following your advice, I have now submitted the log files using the supporttool.exe and am currently awaiting a response from the support team.I will certainly keep you updated and share the outcome here as soon as I receive feedback.Thank you again for your time and assistance.

Best regards,

Low

Alexandru_BD

You're most welcome and thank you for raising the ticket and for sending logs as well. Please allow between 24 to 48hrs for the Support teams to reply (in some cases it may take a bit longer, depending on the workload, available agents and business days, but they will get back to you). If the bug is confirmed, they will escalate the case to the development teams, and if this happens, a final resolution may take a bit longer, especially if they need to work on a fix to be deployed in the upcoming updates.

To give a bit of context in these situations, all reported bugs usually require investigation time. Since product updates are usually released once a month, it may take at least one month until a fix is implemented in the product (if the issue is not critical, of course) - this does not include the debugging period, which may be long or short, depending on the complexity of the problem they are facing.

Thank you once again for taking the time to report this and for sharing your findings with the community.

ktools

Bonjour Niveau bas,

Si je me trompe je rencontre sans doute à peu près la meme chose que vous mais cette foi sur PC Windows 11 25h2 de mon côté j'ai envoyé au support ! Je penses qu'il y a un petit soucis avec les servers Google concernant le moteur de recherche ainsi que Google Images peux être qu'ils sont en maintenance temporaire pour les reCAPTCHA.

Avez-vous reçu un message du support Bitdefender concernant cette problématique ?

Est-ce que d'autres utilisateurs rencontrent ce problème ?

Bitdefender Analyse web chiffrée Problème de reCAPTCHA (Google FR le moteur de recherche) - Expert Community