CVE-2023-44487

# Nginx
nginx -v
# Vulnerable: < 1.25.3

# Apache
apache2 -v  # or httpd -v
# Vulnerable: < 2.4.58

# Node.js
node --version
# Check nghttp2: node -e "console.log(process.versions.nghttp2)"
# Vulnerable nghttp2: < 1.57.0

# Go HTTP servers: check Go version
go version
# Vulnerable Go: < 1.20.10, < 1.21.3

# Check if HTTP/2 is active
curl -I --http2 https://yoursite.com 2>&1 | grep HTTP

# Ubuntu/Debian
apt-get update && apt-get install --only-upgrade nginx
nginx -v  # Must show 1.25.3+

# Or compile from source with latest nghttp2
# Nginx mainline PPA:
add-apt-repository ppa:nginx/stable
apt-get update && apt-get install nginx

# RHEL/CentOS — use Nginx official repo
# nginx.org/packages/rhel/9/

# Test HTTP/2 after upgrade
nginx -t && systemctl reload nginx
curl --http2 -I https://yoursite.com

# nginx.conf — http block
http {
    # Limit concurrent HTTP/2 streams per connection
    http2_max_concurrent_streams 128;  # Default 128, reduce for protection

    # Limit connections per IP
    limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
    limit_conn conn_limit 100;

    # Request rate limiting
    limit_req_zone $binary_remote_addr zone=req_limit:10m rate=100r/s;
    limit_req zone=req_limit burst=200 nodelay;

    # Keepalive timeout
    keepalive_timeout 65;
    keepalive_requests 1000;
}

server {
    limit_conn conn_limit 50;  # Per server block
}

# Cloudflare — enable DDoS protection
# Dashboard → Security → DDoS → Customize DDoS Protection

# Specific HTTP/2 Rapid Reset mitigation:
# Cloudflare automatically blocked this attack during Oct 2023 record attack
# Enable "Under Attack" mode temporarily if under active attack

# CloudFront (AWS) — enable AWS Shield
aws shield create-protection   --name "HTTP2RapidResetProtection"   --resource-arn "arn:aws:cloudfront::123456789:distribution/ABCDEF"

# Or use HAProxy with h2-max-concurrent-streams
# haproxy.cfg:
# tune.http.maxhdr 100
# option http-server-close

# Nginx access log — look for RESET_STREAM pattern
# Indicators: thousands of requests from same IP, rapid connections
tail -f /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -20

# Check for unusually high request rates
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10

# Alert: >1000 requests/minute from single IP
# Set up fail2ban for HTTP flood
# /etc/fail2ban/filter.d/nginx-req-limit.conf:
# [Definition]
# failregex = ^<HOST>.*"(GET|POST)
# ignoreregex =