HTTP/2 Rapid Reset Distributed Denial of Service (DDoS)

Architectural protocol vulnerability in HTTP/2 enabling record-breaking DDoS attacks (>398 million requests per second) via RST_STREAM abuse.

EPSS Exploit Probability98.20%

99.6th percentile

Exploit Maturityactive wild

Active Weaponization

Primary VendorsInternet Engineering Task Force (IETF), Cloudflare, Google, AWS, NGINX, Apache, Envoy

1 product(s) impacted

Ransomware CampaignNone documented

Threat intel association

CVSS v3.1 Vector Breakdown

Comprehensive attack metric decomposition according to FIRST specification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector (AV)NETWORKRemotely exploitable over network

Attack Complexity (AC)LOWNo specialized access needed

Privileges Required (PR)NONEUnauthenticated exploitation

User Interaction (UI)NONEZero-click / autonomous

Scope (S)UNCHANGEDSecurity authority boundary

Confidentiality (C)NONETotal information disclosure

Integrity (I)NONETotal compromise of system state

Availability (A)HIGHComplete resource denial

TechOverwatch AI Security Sentinel Analysis

Model: Gemini 2.0 Flash Security Sentinel · Generated: 2026-10-28

Executive Defense Summary

A fundamental protocol flaw in HTTP/2 exploited by threat actors to generate unprecedented DDoS volumes exceeding 400M RPS, overwhelming web servers and cloud edge infrastructures.

Technical Root Cause Architecture

HTTP/2 stream multiplexing allows clients to request cancellation before server processing completes. Servers commit substantial resources parsing headers and allocating memory before the RST_STREAM is handled, creating an extreme asymmetric workload.

Exploitation Scenario & Attack Chain

Attacker client opens hundreds of concurrent HTTP/2 streams and immediately sends `RST_STREAM` frames in rapid succession over a single TCP connection, exhausting web worker threads.

Enterprise Blast Radius & Lateral Risk

Complete service outage across web-facing applications, customer checkout failures, CDN bandwidth and compute cost spikes.

Remediation & Defense Playbook

Immediate actionable steps for DevOps, SecOps, and Security Architects

1Update web proxies (NGINX, Envoy, Apache, HAProxy) to versions featuring HTTP/2 RST_STREAM rate limits.

2Configure aggressive connection limits: limit the number of active streams per connection and close connections exceeding RST_STREAM thresholds.

3Leverage cloud DDoS protection providers capable of L7 stateful stream inspection.

Detection Guidance & Threat Hunting

Track the ratio of RST_STREAM frames to successful HTTP 200 responses. Ratios above 20% strongly indicate Rapid Reset attack patterns.

Sigma Detection Rule (SIEM Export)

title: HTTP/2 High RST_STREAM Ratio
status: high
logsource:
  category: proxy
detection:
  selection:
    http_protocol: 'HTTP/2.0'
    rst_stream_count|gt: 1000
  condition: selection

Affected Software & CPE Matrix

Targeted versions, patched releases, and Common Platform Enumerations

Vendor	Product	Affected Versions	Fixed In
Multiple	HTTP/2 Web Servers and Reverse Proxies	Implementations adhering to RFC 7540 without RST_STREAM rate limits	NGINX 1.25.3, Envoy 1.28.0, Go 1.21.3

Official Advisories & Authoritative Sources

Google Cloud Security Bloghttps://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack

advisory

Cloudflare Technical Deep Divehttps://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/

advisory

AI Agent & Security Automation Hub

TechOverwatch provides native machine-readable endpoints for autonomous agents, Cursor, Claude, ChatGPT, and automated patch scanners.

Agent CLI Command (curl):

curl -s https://www.techoverwatch.in/api/vulnerabilities/CVE-2023-44487/raw

Raw Markdown JSON API