Aug 25, 2023

Started

• ClosedHigh✓Patched

  HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)

  Attackers abused HTTP/2 stream cancellation (open a request, reset it right away, repeat) to make servers do work at enormous rates. Peaks hit 398M req/s at Google, 201M at Cloudflare and 155M at AWS. Almost every HTTP/2 server and proxy needed a fix, including Node.js, Go, Java servers, .NET/IIS and nginx.

  HTTP/2 protocol implementations (servers, proxies, CDNs)·Closed Oct 10, 2023·updated Oct 10, 2023