What to know about the HTTP/2 Rapid Reset DDoS attacks

Summary: Cisco Talos is tracking DDoS attacks exploiting CVE-2023-44487, a vulnerability in how the HTTP/2 protocol handles request cancellations, where a client can reset a stream and instantly open a new one, rapidly consuming server resources. Beginning in late August, attacks on Cloudflare and other large providers peaked at more than 200 million requests per second using a botnet of only 20,000 systems.
Why it matters: That 200 million requests per second came from just 20,000 machines; the same technique with a much larger botnet could produce traffic orders of magnitude greater, and HTTP/2's integration across web platforms makes widespread impact likely.

Read the original at Cisco Talos ↗

Topics: Endpoint & Network Security
Mentions: CVE-2023-44487
Related: CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability Known Exploited Vulnerabilities · Oct 10, 2023
New HTTP/2 'Made YouReset' Vulnerability Enables Large-Scale DoS Attacks Cyber Risks ·
Top resources for Cybersecurity Awareness Month Cyber Risks ·