How to fix CVE-2023-44487 – Step-by-Step Guide
CVE-2023-44487, known as the HTTP/2 Rapid Reset DDoS Attack, is a critical vulnerability affecting nearly all HTTP/2 server implementations. This high-severity flaw allows attackers to launch highly efficient denial-of-service attacks with minimal resources. It poses a significant threat to web infrastructure globally.
What is HTTP/2 Rapid Reset DDoS Attack?
The HTTP/2 Rapid Reset Attack exploits a flaw in the stream cancellation mechanism of the HTTP/2 protocol. Attackers rapidly open and close thousands of streams within a single connection, overwhelming server resources. This bypasses typical DDoS protections, allowing a small number of requests to trigger a massive denial of service.
Impact and Risks for your Infrastructure
This vulnerability enables extremely efficient DDoS attacks, potentially causing widespread service outages and significant operational disruption. Servers can be overwhelmed with minimal attacker resources, leading to severe performance degradation or complete unavailability. Businesses face reputational damage and financial losses due to service interruptions.
Step-by-Step Mitigation Guide
To mitigate CVE-2023-44487, update your HTTP/2 server implementations immediately to patched versions. For Nginx, upgrade to 1.25.3+ or 1.24.0+. For nghttp2, update to 1.57.0+. Verify the fix by checking your vendor's specific security advisories and confirming the updated version numbers are active.
- 1Update nginx to 1.25.3+, Apache to 2.4.58+, and apply all vendor patches.
- 2Enable Cloudflare or CDN-level DDoS protection.
- 3Set http2_max_concurrent_streams to a low value (e.g., 128) in nginx.
- 4Implement rate limiting on HTTP/2 connections at the edge.
- 5Monitor for traffic spikes and RESET_STREAM frames.
- 6Consider disabling HTTP/2 on exposed endpoints if not required.