Cancellation did not make the request free
On 10 October 2023, major infrastructure providers disclosed HTTP/2 Rapid Reset, tracked as CVE-2023-44487. The technique exploited an imbalance between the cost of creating and cancelling streams on a connection and the work a server had already begun. A client could repeatedly open streams and reset them before completion, keeping the server busy without maintaining a matching population of active requests.
Cloudflare reported an attack above 201 million requests per second. Google reported a separate attack above 398 million requests per second. These are provider-specific observations, not measurements of one shared incident and not estimates of traffic that reached every protected origin.
Why concurrent-stream limits were an incomplete model
HTTP/2 multiplexes multiple streams over a connection. A concurrency limit bounds how many streams are active together. It does not, by itself, bound how many streams can be created and abandoned over a short interval or how much parsing and dispatch work each attempt triggers.
The defensive question is therefore about work admitted over time. Which component receives the reset? Has it already allocated state, parsed headers or dispatched work? Does cancelling the edge stream cancel relevant downstream work? The answers vary by implementation and deployment; they should not be inferred from the protocol name alone.
Map every HTTP/2 termination point
| Layer | Question for its owner | Useful verification |
|---|---|---|
| Public edge or CDN | What receives the client's HTTP/2 connection? | Provider mitigation statement and configuration |
| Load balancer or ingress | Can it be reached directly or through another hostname? | Listener inventory and access policy |
| Reverse proxy | Does it terminate HTTP/2 separately? | Product advisory and deployed build |
| Application server | Can an upstream bypass expose it? | Network reachability and server configuration |
A protected public hostname does not establish that an origin address, an administrative hostname or a second ingress path receives the same protection. Review authorised inventory rather than testing arbitrary external services.
CERT-EU's advisory recommends identifying internet-exposed HTTP/2 services and applying the relevant patches or mitigations. Microsoft's disclosure identifies fixes for its affected implementation families. These documents are more useful for a product decision than an assumption that one generic rate-limit setting covers every server.
Signals to collect before an outage
Keep connection rate, new-stream rate, reset rate and server resource use distinguishable in monitoring. A graph of completed successful responses alone can miss work that was accepted and then cancelled. Ask whether the available telemetry measures requests at the edge, at a proxy or in the application.
For a change review, record a normal baseline and the impact of the chosen mitigation on legitimate clients. Do not turn an incident retrospective into a production stress test. Any load test needs explicit scope, a controlled environment and a stop condition.
An operational runbook should state who can change edge settings, whether the origin can be isolated from direct traffic, and how to contact the relevant provider. Those permissions are harder to improvise when the management interface shares the overloaded path.
How this differs from Log4Shell
Log4Shell made dependency reachability central to code-execution risk. Rapid Reset made protocol termination and resource accounting central to availability. In both cases, a service name on an asset list is too coarse: responders need to know which component accepts untrusted input and where the consequential work happens.
The practical lesson is to describe exposure as a path through the deployment. “We use a CDN” and “we patched the application” are incomplete descriptions if another component terminates the vulnerable protocol.
Follow the stream lifecycle
The client can open an HTTP/2 stream with HEADERS and immediately send RST_STREAM. The reset closes the stream from the concurrency perspective, permitting another to be opened, while work associated with earlier requests may already have entered parsing, allocation or dispatch. Repetition creates a mismatch between the client's active stream population and the server work admitted over time.
That is why a simple concurrent-stream ceiling does not fully describe the resource control. Implementation mitigations need to account for abusive creation/reset behaviour and the work triggered by it. The precise counters and connection-handling choices are product-specific; there is no universal safe numeric limit to copy into every deployment.
Record fixes at the implementation boundary
Apache's record identifies a related reset-memory issue, CVE-2023-45802, found during testing of Rapid Reset and fixed in 2.4.58. It is a separate CVE, not an alternate identifier for CVE-2023-44487. Microsoft's October 2023 response covers IIS/HTTP.sys, Kestrel and Windows implementation families. CERT-EU aggregates affected products and links the vendor guidance.
| Termination implementation | Evidence for the historical response | What the operator still verifies |
|---|---|---|
| Apache HTTP Server with HTTP/2 | Related CVE-2023-45802: Apache's 2.4.58 boundary; review Rapid Reset guidance separately |
Distribution backport, deployed build and enabled modules |
| Microsoft implementation families | MSRC response and the applicable October 2023 update guidance | Product/OS identity and installed update evidence |
| Other proxies and servers | The exact vendor's CVE-2023-44487 advisory | Whether that component terminates reachable HTTP/2 |
The table deliberately avoids inferring one product's fix from another's protocol support. Use current supported software for maintenance, rather than treating a historical emergency release as the target forever.
A single negotiation check is not an attack test
On a client built with HTTP/2 support, a normal HEAD request to an endpoint the team controls can show whether that route negotiates HTTP/2:
curl -V
curl --http2 -I https://your-authorised-host.example/
The hostname is illustrative. Use an explicitly authorised service, and inspect the response and client capabilities. This sends one ordinary request; it does not exercise the Rapid Reset vulnerability, measure flood resistance or inspect a protected origin behind a CDN.
Compare the result with the listener inventory and product configuration. A CDN-facing response establishes the client-to-edge path, not necessarily the edge-to-origin protocol. An origin reachable through a separate address or hostname needs its own ownership and access review.
Two failure modes to keep separate
The WebP response in September 2023 and Brotli response in October 2026 concern vulnerable decoders consuming untrusted content. Rapid Reset concerns resource accounting around stream lifecycle. They share an inventory problem, but not an exploit trigger.
For decoder incidents, the central question is which copy processes the input. Here it is which component terminates the protocol and commits work before cancellation. That distinction should determine the diagram, telemetry and mitigation checklist instead of every vulnerability report repeating the same generic patch advice.