HTTP/2 Rapid Reset: a protocol flaw that turned into the largest attacks ever recorded

What it actually is

A client streams RST_STREAM frames to cancel requests as fast as it can create them. The server keeps allocating and tearing down request state while the connection limit is never reached, because cancelled streams do not count against it.

What an attacker gets: Denial of service, at a scale that made it notable. No data disclosure and no code execution.

When it applies to you, and when it does not

An old package version and a real exposure are different things. These are the conditions this one needs.

• HTTP/2 has to be enabled and reachable. A server behind a reverse proxy or a CDN that terminates HTTP/2 is protected by whatever that layer does, not by its own version.
• The fixes are rate limits and accounting changes rather than a single corrected line, so different servers addressed it differently and on different dates.
• This is the clearest case on this site of a CVE being about a protocol rather than a package. nginx carries advisories for it, and Apache HTTP Server's own package carries none on these releases. On Rocky Linux and AlmaLinux, though, Apache's HTTP/2 support is a separate package, mod_http2, and AlmaLinux's advisory for that package names this CVE: read the mod_http2 table as well.

Check your own server

ss -lntp | grep -E ':(80|443)' && (nginx -V 2>&1 | grep -o with-http_v2_module; grep -rn 'http2' /etc/nginx/ 2>/dev/null | head -5)

The question is whether anything on this machine terminates HTTP/2 for the internet, not which version it is.

Fixed package version, per distribution

From each distribution’s own advisory data, asked per release. A version here is the package version that carries the fix on that release, not the upstream release number.

What SecAI has recorded about it

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Recorded from nvd. Its weakness class is CWE-400, from NVD.

• http://www.openwall.com/lists/oss-security/2023/10/10/6
• http://www.openwall.com/lists/oss-security/2023/10/10/7
• http://www.openwall.com/lists/oss-security/2023/10/13/4
• http://www.openwall.com/lists/oss-security/2023/10/13/9
• http://www.openwall.com/lists/oss-security/2023/10/18/4
• http://www.openwall.com/lists/oss-security/2023/10/18/8

Read next

Other CVEs explained in full