HTTP/2
Security incidents tagged HTTP/2. Newest first.
0 HTTP/2 incidents in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 0
- Patched
- 1
- Days without an incident
- 1108
- Longest quiet run: 1108 days (Oct 11–Oct 22)
Show 1 older incident1 older incident
August 2023 1
- HighPatched
HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)
Attackers abused HTTP/2 stream cancellation (open a request, reset it right away, repeat) to make servers do work at enormous rates. Peaks hit 398M req/s at Google, 201M at Cloudflare and 155M at AWS. Almost every HTTP/2 server and proxy needed a fix, including Node.js, Go, Java servers, .NET/IIS and nginx.
HTTP/2 protocol implementations (servers, proxies, CDNs)Closed Oct 10, 2023
