CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability

CVE-2023-44487 is a vulnerability in the HTTP/2 protocol that enables a rapid reset attack capable of driving distributed denial-of-service (DDoS) conditions. It matters because HTTP/2 is widely deployed across web servers, reverse proxies, load balancers, and cloud edge services; successful abuse can exhaust server resources and disrupt availability for legitimate traffic. Confirm exact impact and affected implementations against the relevant vendor advisories.

CISA characterizes the issue as allowing DDoS via rapid reset and directs organizations to apply vendor mitigations, follow BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable. Ransomware use is not documented for this CVE.

How it works

The weakness is classified as CWE-400 (uncontrolled resource consumption). HTTP/2 supports multiplexed streams over a single connection and allows clients to cancel streams with RST_STREAM frames. An attacker can open many streams and immediately reset them in rapid succession. Each open-and-reset cycle still consumes server-side state and processing capacity for stream setup and teardown. When performed at high volume, often from multiple sources, this overwhelms the target’s ability to handle legitimate connections, producing a denial-of-service condition. Specific frame sequences, rate thresholds, or library behaviors vary by implementation; treat any public exploit descriptions as unconfirmed until validated against the vendor advisory for your stack.

Am I affected? How to find it in your systems

HTTP/2 is commonly enabled by default or via configuration on modern web servers, application servers, reverse proxies, CDNs, API gateways, and cloud load balancers. Inventory systems that terminate or proxy HTTP/2 traffic:

• Enumerate public-facing and internal web tiers, reverse proxies, and load balancers; check whether HTTP/2 (h2 or h2c) is negotiated.
• Review software inventories and configuration management databases for HTTP/2-capable products and libraries; note versions and confirm support status against each vendor’s advisory for CVE-2023-44487.
• Inspect TLS and ALPN settings that advertise HTTP/2, and review any custom or third-party HTTP/2 stacks embedded in applications.
• Look for telemetry indicators of abuse: sudden spikes in RST_STREAM frames, elevated stream creation/cancellation rates, connection churn, or resource exhaustion (CPU, memory, connection tables) correlated with HTTP/2 traffic. Compare against baseline rates; anomalous rapid-reset patterns may appear in access logs, proxy metrics, or network flow data.

Because the flaw is protocol-level, any implementation that processes HTTP/2 streams without adequate rate or concurrency controls may be exposed. Exact vulnerable versions and configurations must be confirmed against the vendor advisory.

How to remediate

Patch first. Apply the vendor-supplied updates or configuration changes that address CVE-2023-44487 for every HTTP/2 implementation in your environment. Follow the CISA-required action: apply mitigations per vendor instructions, adhere to applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

After patching, harden the class of issue:

• Enforce reasonable limits on concurrent streams, stream creation rate, and RST_STREAM frequency at the server, proxy, or load-balancer layer.
• Prefer implementations that have been updated to handle rapid resets efficiently and that expose tunable resource controls.
• Disable HTTP/2 where it is not required, falling back to HTTP/1.1 for lower-risk services after validating application compatibility.
• Ensure monitoring and alerting cover stream metrics so residual abuse attempts are visible.

Re-validate after changes by confirming the patched versions and re-testing HTTP/2 negotiation and resource behavior under load.

If you can't patch immediately

Reduce exposure with compensating controls until patches can be applied:

• Segment and restrict access to HTTP/2 endpoints; place them behind hardened reverse proxies or CDNs that already incorporate rapid-reset mitigations.
• Apply virtual patching or WAF/proxy rules that rate-limit stream opens, resets, or overall connection churn; many vendors published interim configuration guidance—confirm and deploy those settings.
• Temporarily disable HTTP/2 on high-risk or non-essential services if the feature can be turned off without breaking critical clients.
• Increase capacity headroom and enable aggressive connection and stream limits; monitor for the telemetry signs listed above and prepare to block abusive source networks.
• For cloud-hosted services, follow the provider’s BOD 22-01-aligned guidance and enable any available DDoS or protocol-level protections.

These steps lower risk but do not replace the vendor fix; schedule patching as soon as practicable.

If your data may have been exposed

Actively exploited vulnerabilities that enable DDoS can be used as cover or precursor for broader compromise, and successful attacks may lead to service disruption or secondary breaches. Review logs for signs of successful resource exhaustion or follow-on activity. If you believe credentials or personal data may have been involved in any related incident, check whether your email addresses appear in known breach data by running a free exposure scan.