HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 10 Oct 2023

ronjor · Oct 10, 2023

Release Date October 10, 2023

Researchers and vendors have disclosed a denial-of-service (DoS) vulnerability in HTTP/2 protocol. The vulnerability (CVE-2023-44487), known as Rapid Reset, has been exploited in the wild in August 2023 through October 2023.
Click to expand...

CISA recommends organizations that provide HTTP/2 services apply patches when available and consider configuration changes and other mitigations discussed in the references below. For more information on Rapid Reset, see:
Click to expand...

ronjor · Oct 10, 2023

Microsoft Response to Distributed Denial of Service (DDoS) Attacks against HTTP/2

MSRC / By MSRC / October 10, 2023 / 5 min read
Beginning in September 2023, Microsoft was notified by industry partners about a newly identified Distributed Denial-of-Service (DDoS) attack technique being used in the wild targeting HTTP/2 protocol. This vulnerability (CVE-2023-44487) impacts any internet exposed HTTP/2 endpoints.
Click to expand...

As an industry leader, Microsoft promptly opened an investigation and subsequently began working with industry partners for a coordinated disclosure and mitigation plan. Microsoft recommends customers follow the guidance provided in this blog to ensure your services are hardened and protected against this DDoS attack technique.
Click to expand...

Log in or Sign up

HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 10 Oct 2023

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 10 Oct 2023

ronjor Global Moderator

ronjor Global Moderator

Useful Searches