Researchers and vendors have disclosed a denial-of-service (DoS) vulnerability in HTTP/2 protocol. The vulnerability (CVE-2023-44487), known as Rapid Reset, has been exploited in the wild in August 2023 through October 2023.
CISA recommends organizations that provide HTTP/2 services apply patches when available and consider configuration changes and other mitigations discussed in the references below. For more information on Rapid Reset, see:
Google: How it works: The novel HTTP/2 ‘Rapid Reset’ DDoS attackAWS: CVE-2023-44487 – HTTP/2 Rapid Reset AttackNGINX: HTTP/2 Rapid Reset Attack Impacting NGINX Products
Microsoft Response to Distributed Denial of Service (DDoS) Attacks against HTTP/2
Organizations can take proactive steps to reduce the effects of DoS attacks. See the following guidance for more information:
- CISA: Understanding and Responding to Distributed Denial-of-Service Attacks
- CISA: Additional DDoS Guidance for Federal Agencies
Source: https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
Comentários