# [CVE-2023-44487] HTTP/2 Rapid Reset Distributed Denial of Service (DDoS)
**Severity:** HIGH | **CVSS Base Score:** 7.5 (3.1)
**CVSS Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
**EPSS Exploit Probability:** 98.20% (Percentile: 99.60%)
**CISA KEV (In The Wild):** YES (Due: Tue Oct 31 2023 00:00:00 GMT+0000 (Coordinated Universal Time))
**Known Ransomware Campaigns:** None documented
**Exploit Status:** active_wild
**Published:** 2023-10-10 | **Updated:** 2026-10-28

## Executive Summary
Architectural protocol vulnerability in HTTP/2 enabling record-breaking DDoS attacks (>398 million requests per second) via RST_STREAM abuse.

## Common Weakness Enumeration (CWE)
- **CWE-400**: Uncontrolled Resource Consumption

## Affected Vendors & Products
- **Vendor:** Multiple | **Product:** HTTP/2 Web Servers and Reverse Proxies
  - **Affected Versions:** Implementations adhering to RFC 7540 without RST_STREAM rate limits
  - **Patched Version:** NGINX 1.25.3, Envoy 1.28.0, Go 1.21.3

## Technical Root Cause Analysis (AI Defense Agent)
HTTP/2 stream multiplexing allows clients to request cancellation before server processing completes. Servers commit substantial resources parsing headers and allocating memory before the RST_STREAM is handled, creating an extreme asymmetric workload.

## Exploitation Mechanism & Attack Scenario
Attacker client opens hundreds of concurrent HTTP/2 streams and immediately sends `RST_STREAM` frames in rapid succession over a single TCP connection, exhausting web worker threads.

## Enterprise Blast Radius
Complete service outage across web-facing applications, customer checkout failures, CDN bandwidth and compute cost spikes.

## Remediation & Mitigation Playbook
1. Update web proxies (NGINX, Envoy, Apache, HAProxy) to versions featuring HTTP/2 RST_STREAM rate limits.
2. Configure aggressive connection limits: limit the number of active streams per connection and close connections exceeding RST_STREAM thresholds.
3. Leverage cloud DDoS protection providers capable of L7 stateful stream inspection.

## Detection Guidance & Telemetry
Track the ratio of RST_STREAM frames to successful HTTP 200 responses. Ratios above 20% strongly indicate Rapid Reset attack patterns.

### Sigma Detection Rule
```yaml
title: HTTP/2 High RST_STREAM Ratio
status: high
logsource:
  category: proxy
detection:
  selection:
    http_protocol: 'HTTP/2.0'
    rst_stream_count|gt: 1000
  condition: selection
```


## References
- [Google Cloud Security Blog](https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack) (advisory)
- [Cloudflare Technical Deep Dive](https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/) (advisory)