HTTP/2 Rapid Reset: what to patch
A flaw in HTTP/2 itself enabled the largest DDoS attacks ever seen. Update your web servers and load balancers.
Last week Google, Cloudflare and AWS described a new DDoS technique that broke every record. Google reported a peak of 398 million requests per second. It abuses HTTP/2 itself: open a request, cancel it immediately, repeat, very fast. The server does work for each one, the attacker almost none.
It’s a protocol issue (CVE-2023-44487), so almost every HTTP/2 server was affected.
What to do:
- Update your web servers and proxies: nginx, Apache, IIS, Envoy, HAProxy and others have released fixes or settings.
- Update load balancers and application gateways, including the ones from your cloud provider if you manage them.
- If you sit behind a CDN that has already mitigated this, you’re largely covered. Make sure your origin isn’t reachable directly.
- Check your limits: concurrent streams per connection, and request rates per client.
The big providers absorbed this one. A small server facing the internet on its own wouldn’t have.