ClosedPatched

HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)

HTTP/2 protocol implementations (servers, proxies, CDNs)

Attackers abused HTTP/2 stream cancellation (open a request, reset it right away, repeat) to make servers do work at enormous rates. Peaks hit 398M req/s at Google, 201M at Cloudflare and 155M at AWS. Almost every HTTP/2 server and proxy needed a fix, including Node.js, Go, Java servers, .NET/IIS and nginx.

Why this severity: CVSS 7.5 (NVD), exploited in the wild Aug–Oct 2023 (CISA KEV)

Started: Aug 25, 2023
Closed: Oct 10, 2023
CVE: CVE-2023-44487

Follow this incident

Updated Oct 10, 2023

Affected

Most HTTP/2 implementations; see each vendor's advisory

Fixed in

See vendor advisories (each HTTP/2 implementation shipped its own fix)

Timeline2

Oct 10, 2023
Coordinated disclosure by Google, Cloudflare and AWS; CISA adds CVE-2023-44487 to KEV
Source
Aug 25, 2023
Cloudflare starts seeing unusually large HTTP/2 attacks
Source

Advisories2

News & write-ups2

Notes & caveats

Stacks: Node.js, Go (x/net/http2), Java servers (Tomcat, Jetty, Netty) and .NET/IIS all shipped fixes; check your runtime's own advisory.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified