https://pwn.watch/t/http2 Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Tue, 10 Oct 2023 00:00:00 GMT https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487 https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487 Tue, 10 Oct 2023 00:00:00 GMT high <p>Attackers abused HTTP/2 stream cancellation (open a request, reset it right away, repeat) to make servers do work at enormous rates. Peaks hit 398M req/s at Google, 201M at Cloudflare and 155M at AWS. Almost every HTTP/2 server and proxy needed a fix, including Node.js, Go, Java servers, .NET/IIS and nginx.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisories (each HTTP/2 implementation shipped its own fix)</p> <p><strong>Latest updates:</strong></p><ul><li>2023-10-10: Coordinated disclosure by Google, Cloudflare and AWS; CISA adds CVE-2023-44487 to KEV (<a href="https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack">source</a>)</li><li>2023-08-25: Cloudflare starts seeing unusually large HTTP/2 attacks (<a href="https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2023-44487</p>