Technical Advisory · Retrospective 2023
HTTP/2 Rapid Reset: map the work a cancelled stream leaves behind
CVE-2023-44487 made request churn and protocol termination more useful questions than a connection count alone.
CVE-2023-44487
Technical coverage, source documents and official vulnerability records.
FISRO coverage
Read the relevant deployment conditions, remediation steps and limits of the evidence in the linked material.
Sources from this coverage
- HTTP/2 Rapid Reset: deconstructing the record-breaking attackCloudflare
- How it works: The novel HTTP/2 Rapid Reset DDoS attackGoogle Cloud
- HTTP/2 Rapid Reset DDoS Vulnerability, 2023-074CERT-EU
- Microsoft Response to DDoS Attacks against HTTP/2Microsoft Security Response Center
- Apache HTTP Server security recordApache Software Foundation