How to fix CVE-2023-44487 – Step-by-Step Guide
CVE-2023-44487, known as the HTTP/2 Rapid Reset DDoS Attack, is a high-severity vulnerability published on October 10, 2023. This critical flaw allows attackers to launch massive denial-of-service attacks by exploiting a design weakness in the HTTP/2 protocol. It affects virtually all HTTP/2 server implementations.
What is HTTP/2 Rapid Reset DDoS Attack?
The HTTP/2 Rapid Reset Attack leverages the protocol's stream cancellation mechanism. Attackers repeatedly send requests and immediately cancel them, creating a massive backlog of processing work for the server without fully opening new connections. This overwhelms server resources, leading to a denial of service with minimal attacker bandwidth.
Impact and Risks for your Infrastructure
This vulnerability enables highly efficient DDoS attacks, potentially causing significant service outages and revenue loss. Infrastructure can be overwhelmed with minimal attacker resources, leading to severe performance degradation or complete unavailability of web services.
Step-by-Step Mitigation Guide
Immediately update all HTTP/2 server implementations to patched versions. For Nginx, upgrade to 1.25.3+ or 1.24.0+. For nghttp2, update to 1.57.0+. Verify the fix by checking your server software version and monitoring for unusual HTTP/2 traffic patterns or resource spikes.
- 1Update nginx to 1.25.3+, Apache to 2.4.58+, and apply all vendor patches.
- 2Enable Cloudflare or CDN-level DDoS protection.
- 3Set http2_max_concurrent_streams to a low value (e.g., 128) in nginx.
- 4Implement rate limiting on HTTP/2 connections at the edge.
- 5Monitor for traffic spikes and RESET_STREAM frames.
- 6Consider disabling HTTP/2 on exposed endpoints if not required.