Cybersecurity glossary
What is HTTP/2 Rapid Reset (CVE-2023-44487)?
Learn what HTTP/2 Rapid Reset (CVE-2023-44487) is, how RST_STREAM floods exhaust servers, how it fueled record DDoS events in 2023, and which rate limits and HTTP/2 settings mitigate it.
Definition
HTTP/2 Rapid Reset, tracked as CVE-2023-44487, is a denial-of-service technique that opens and immediately cancels many HTTP/2 streams (typically via RST_STREAM) so servers and proxies spend work creating stream state that is torn down before useful responses complete—allowing a single connection to generate extreme request rates that overwhelm targets.
Why HTTP/2 Rapid Reset mattered
In late 2023, hyperscale providers disclosed DDoS campaigns that smashed previous peak request rates. The technique behind many of those spikes was named HTTP/2 Rapid Reset and tracked as CVE-2023-44487.
The attack did not invent a new cryptographic break. It abused a legitimate HTTP/2 feature—stream cancellation—at inhuman speed. Defenders learned again that protocol efficiency features can become load amplifiers when servers trust clients to behave reasonably.
What CVE-2023-44487 actually is
HTTP/2 allows many concurrent streams on one connection. A client can start a stream (request) and cancel it with RST_STREAM before the response finishes. Rapid Reset chains these create-and-cancel cycles so quickly that servers allocate stream state, parse headers, and sometimes touch backends while never delivering useful work to a real user.
Mechanism
Flood of HTTP/2 stream opens followed almost immediately by RST_STREAM cancellations.
Amplification idea
One TCP/TLS connection generates enormous effective request rates without HTTP/1.1 connection churn.
Impact
CPU, memory, and upstream exhaustion on proxies, API gateways, and origin applications.
CVE framing
Implementations lacked sufficient safeguards against abusive cancellation patterns.
How the Rapid Reset attack works
Complete a normal HTTP/2 handshake
The attacker establishes TLS and HTTP/2 SETTINGS like any client, often through a botnet of compromised hosts.
Open streams at high rate
Many HEADERS frames create new streams, each representing a request the server begins to process.
Cancel immediately
RST_STREAM frames tear streams down before responses complete, freeing client-side limits while servers still pay costs.
Repeat continuously
Create/cancel loops push request rates far beyond what connection-count heuristics expect.
Saturate the target path
Load balancers, shared proxies, or origins tip over; legitimate multiplexed clients share the pain.
Variants refine frame ordering and timing, but the operational signature remains: extreme stream churn relative to useful completed responses.
Rapid Reset versus other HTTP DoS styles
| Property | Rapid Reset | Slowloris | Volumetric DDoS |
|---|---|---|---|
| Primary resource hit | Stream/CPU on HTTP/2 stacks | Connection worker slots | Bandwidth / network pipes |
| Protocol focus | HTTP/2 RST_STREAM churn | Slow HTTP/1.x headers/body | UDP/TCP floods, amplification |
| Bytes per unit damage | Often low—logic amplification | Very low, long-lived sockets | High packet/bit volume |
| Fix theme | Stream rate limits + patches | Timeouts + connection limits | Scrubbing / anycast capacity |
| CVE-2023-44487? | Yes | No | No |
Who was affected
Any publicly reachable HTTP/2 terminator without adequate stream-cancellation controls was a candidate: CDN edges, reverse proxies (nginx, Envoy, Apache, vendor appliances), API gateways, and language HTTP servers. Customers behind large providers sometimes felt mitigated earlier than teams running self-managed edges on modest hardware.
Internal mesh proxies speaking HTTP/2 were also worth reviewing: not every Rapid Reset lesson applies only to the public Internet.
Mitigations
Patch HTTP/2 implementations
Apply vendor fixes tied to CVE-2023-44487 that constrain abusive reset behavior.
Rate-limit stream lifecycle
Limit stream creation and cancellation rates per connection and per IP aggregate.
Tune HTTP/2 SETTINGS
Lower maximum concurrent streams and related parameters to values your backends can survive.
Edge DDoS controls
Use provider detection for Rapid Reset signatures and automatic challenge or shed policies.
What practitioners should do today
- Confirm every HTTP/2 edge (CDN, ingress controller, load balancer, origin) has CVE-2023-44487 patches applied.
- Set conservative max concurrent streams and monitor for clients that open huge stream counts.
- Alert on elevated RST_STREAM rates relative to successful responses.
- Load-test stream cancellation abuse in staging before peak traffic seasons.
- Ensure autoscaling and overload shedding fail gracefully when stream churn spikes.
- Keep HTTP/1.1 available as a controlled fallback during active incidents if needed—not as permanent disablement without analysis.
- Review gRPC/HTTP2 meshes for the same class of stream abuse controls.
- Subscribe to upstream security advisories for proxies you build into golden images.
Lessons Rapid Reset left for protocol operations
Rapid Reset reinforced that multiplexing shifts DoS math. Limits expressed as “connections per IP” are insufficient when one connection carries unbounded logical requests. Protocol features that assume cooperative clients need explicit abuse budgets.
It also showed the value of coordinated disclosure across cloud providers: shared understanding of frame-level patterns produced faster edge defenses than any single origin could invent alone.
The practical takeaway
HTTP/2 Rapid Reset (CVE-2023-44487) exhausts servers by opening and immediately canceling streams at massive rates. Patch HTTP/2 stacks, rate-limit stream churn, tune concurrency settings, and monitor reset-heavy connections. HTTP/2 remains valuable—but only with the same adversarial mindset you already apply to classic connection floods.
Related security terms
HTTP/2
Multiplexed protocol whose stream lifecycle Rapid Reset abuses for request amplification on one connection.
Denial of Service (DoS)
Impact class: service unavailability through resource exhaustion rather than data theft.
Distributed Denial of Service (DDoS)
How Rapid Reset was weaponized at Internet scale against large providers in 2023.
Resource Exhaustion
Broader failure mode when stream churn consumes CPU, memory, or backend capacity.
Slowloris
Contrasting HTTP DoS style that holds connections open slowly instead of canceling streams rapidly.
Frequently asked questions
What is HTTP/2 Rapid Reset in simple terms?
The attacker opens many HTTP/2 requests on one connection and cancels them almost immediately. The server still does expensive setup work for each stream, so a modest botnet can create a huge load.
What is CVE-2023-44487?
CVE-2023-44487 is the vulnerability identifier used for HTTP/2 Rapid Reset denial-of-service exposure in implementations that insufficiently constrain rapid stream cancellation behavior.
Why does HTTP/2 make this worse than HTTP/1.1?
HTTP/2 multiplexes many streams over one TCP/TLS connection. Cancelling streams avoids hitting simple per-connection request limits that existed in HTTP/1.1 thinking.
Was this used in real attacks?
Yes. Major cloud and CDN providers reported record-breaking DDoS events in August–October 2023 linked to Rapid Reset techniques.
Does Rapid Reset steal data?
No. It is an availability attack. The goal is to overwhelm reverse proxies, load balancers, or origin servers so legitimate users cannot be served.
How do you mitigate CVE-2023-44487?
Patch HTTP/2 stacks, rate-limit stream cancellations and creations, tune max concurrent streams, and use provider-layer DDoS controls that detect Rapid Reset patterns.
Is disabling HTTP/2 required?
Usually no. Patched implementations and sensible limits keep HTTP/2 benefits while reducing abuse. Temporary HTTP/1.1 fallback is a last resort during active incidents.
References
Explore authoritative guidance and frameworks related to http/2 rapid reset (cve-2023-44487).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.