{"status":"success","data":{"id":"CVE-2023-44487","slug":"cve-2023-44487-http2-rapid-reset-ddos","title":"HTTP/2 Rapid Reset Distributed Denial of Service (DDoS)","summary":"Architectural protocol vulnerability in HTTP/2 enabling record-breaking DDoS attacks (>398 million requests per second) via RST_STREAM abuse.","description":"The HTTP/2 protocol allows a client to open a stream and rapidly cancel it using the RST_STREAM frame. Because server-side stream cancellation requires non-trivial processing while the client incurs negligible cost, an attacker can pipeline millions of requests, causing server CPU exhaustion and service failure.","severity":"HIGH","cvss_score":7.5,"cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_metrics":{"scope":"UNCHANGED","integrity":"NONE","attackVector":"NETWORK","availability":"HIGH","confidentiality":"NONE","userInteraction":"NONE","attackComplexity":"LOW","privilegesRequired":"NONE"},"epss_score":0.982,"epss_percentile":0.996,"cisa_kev":true,"cisa_date_added":"2023-10-10T00:00:00.000Z","cisa_due_date":"2023-10-31T00:00:00.000Z","ransomware_campaign":null,"threat_actors":["Botnet operators","DDoS-for-hire cartels"],"exploit_status":"active_wild","cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"affected_vendors":["Internet Engineering Task Force (IETF)","Cloudflare","Google","AWS","NGINX","Apache","Envoy"],"affected_products":[{"cpe":"cpe:2.3:a:*:*:*:*:*:*:*:*:*","vendor":"Multiple","product":"HTTP/2 Web Servers and Reverse Proxies","fixed_version":"NGINX 1.25.3, Envoy 1.28.0, Go 1.21.3","affected_versions":"Implementations adhering to RFC 7540 without RST_STREAM rate limits"}],"ai_analysis":{"sigma_rule":"title: HTTP/2 High RST_STREAM Ratio\nstatus: high\nlogsource:\n  category: proxy\ndetection:\n  selection:\n    http_protocol: 'HTTP/2.0'\n    rst_stream_count|gt: 1000\n  condition: selection","analyzed_at":"2026-10-28T09:00:00.000Z","model_provider":"Gemini 2.0 Flash Security Sentinel","executive_summary":"A fundamental protocol flaw in HTTP/2 exploited by threat actors to generate unprecedented DDoS volumes exceeding 400M RPS, overwhelming web servers and cloud edge infrastructures.","detection_guidance":"Track the ratio of RST_STREAM frames to successful HTTP 200 responses. Ratios above 20% strongly indicate Rapid Reset attack patterns.","mitigation_playbook":["Update web proxies (NGINX, Envoy, Apache, HAProxy) to versions featuring HTTP/2 RST_STREAM rate limits.","Configure aggressive connection limits: limit the number of active streams per connection and close connections exceeding RST_STREAM thresholds.","Leverage cloud DDoS protection providers capable of L7 stateful stream inspection."],"technical_root_cause":"HTTP/2 stream multiplexing allows clients to request cancellation before server processing completes. Servers commit substantial resources parsing headers and allocating memory before the RST_STREAM is handled, creating an extreme asymmetric workload.","exploitation_mechanism":"Attacker client opens hundreds of concurrent HTTP/2 streams and immediately sends `RST_STREAM` frames in rapid succession over a single TCP connection, exhausting web worker threads.","enterprise_blast_radius":"Complete service outage across web-facing applications, customer checkout failures, CDN bandwidth and compute cost spikes."},"references":[{"url":"https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack","type":"advisory","title":"Google Cloud Security Blog"},{"url":"https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/","type":"advisory","title":"Cloudflare Technical Deep Dive"}],"published_at":"2023-10-10T14:00:00.000Z","updated_at":"2026-10-28T18:00:00.000Z"}}