HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487

Summary

The HTTP/2 protocol has been found to be vulnerable to a denial-of-service (DoS) attack, known as Rapid Reset (CVE-2023-44487), which has been exploited in the wild since August 2023. This vulnerability allows attackers to exhaust the HTTP/2 connection pool, resulting in a sustained denial-of-service attack.

The vulnerability affects organizations that provide HTTP/2 services and can be exploited by sending a large number of HTTP/2 sessions with low-completed but high-established connections. This can cause the targeted systems to consume excessive resources, leading to a denial-of-service condition.

Several key players in the industry have disclosed information about the vulnerability, including Cloudflare, Google, AWS, and NGINX. Microsoft has also published guidance on responding to DDoS attacks against HTTP/2.

In response to the vulnerability, CISA has recommended that organizations affected by HTTP/2 services apply patches when available and consider configuration changes and other mitigations. CISA has also published guidance for understanding and responding to DDoS attacks, as well as additional guidance for federal agencies.

To reduce the effects of DoS attacks, organizations can take proactive steps. This includes:

Applying patches when available to address the Rapid Reset vulnerability
Implementing configuration changes to mitigate the impact of the attack
Monitoring systems for signs of attack and responding quickly to potential incidents
Implementing robust DDoS protection measures, such as those provided by cloud service providers and DDoS mitigation services
* Developing incident response plans to ensure effective response to DDoS attacks

It is essential for organizations providing HTTP/2 services to prioritize address this vulnerability and take steps to mitigate its impact.