HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487
Cybersecurity and Infrastructure Security Agency sent this bulletin at 10/10/2023 05:15 PM EDT
You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information has recently been updated, and is now available.
10/10/2023 08:00 AM EDT
Researchers and vendors have disclosed a denial-of-service (DoS) vulnerability in HTTP/2 protocol. The vulnerability (CVE-2023-44487), known as Rapid Reset, has been exploited in the wild in August 2023 through October 2023.
CISA recommends organizations that provide HTTP/2 services apply patches when available and consider configuration changes and other mitigations discussed in the references below. For more information on Rapid Reset, see:
- Cloudflare: HTTP/2 Rapid Reset: deconstructing the record-breaking attack
- Google: How it works: The novel HTTP/2 ‘Rapid Reset’ DDoS attack
- AWS: CVE-2023-44487 - HTTP/2 Rapid Reset Attack
- NGINX: HTTP/2 Rapid Reset Attack Impacting NGINX Products
Organizations can take proactive steps to reduce the effects of DoS attacks. See the following guidance for more information: