How to mitigate the HTTP/2 Rapid Reset vulnerability
Find out how to manage the HTTP/2 Rapid Reset vulnerability
Introduction
On October 10th 2023, researchers and vendors disclosed an HTTP/2 protocol behaviour that enables a Layer 7 denial-of-service (DoS) attack.
Tracked as CVE-2023-44487, the issue lets an attacker create additional load on web servers over the HTTP/2 protocol, which could lead to a denial of service.
An attacker can exploit the vulnerability by quickly initiating and cancelling a large number of HTTP/2 streams over an established connection causing excessive resource consumption server-side with minimal client-side attacker cost. This technically circumvents the server's concurrent stream maximum limit because incoming streams are reset faster than subsequent streams arrive.
Several variants of this first behaviour have emerged, each using a different request order, which lets them bypass mitigations based on the rate of inbound reset streams.
Impacts on OVHcloud products
How to mitigate the vulnerability
OVHcloud-initiated mitigation
If you are using any of the services above, OVHcloud took the appropriate actions to mitigate the vulnerability and you are not impacted.
Customer-initiated mitigation
If your website is hosted on a Cloud Instance (Public Cloud or Hosted Private Cloud) or on a Bare Metal Server having HTTP/2 enabled and exposed on the Internet, we recommend applying the latest updates to improve your resiliency.
Major vendors have released advisories and statements to guide you and provide more information.
External references
National vulnerability database - CVE-2023-44487 Detail