On October 10, 2023, Cloudflare, Google and AWS disclosed HTTP/2 Rapid Reset, tracked as CVE-2023-44487. The technique had been used in large distributed denial-of-service attacks. It illustrated how protocol behavior could put pressure on a service before an application processed a normal request.
A risk to service availability
HTTP/2 supports multiple exchanges over a connection. Rapid Reset abused the handling of streams and their cancellation to impose disproportionate work on affected implementations. The practical concern was resource exhaustion and disruption, rather than a flaw in a particular content-management system.
Google and Cloudflare described attacks observed on their own infrastructure. Those reports established the scale of the industry incident; they did not prove that every HTTP/2 service was vulnerable or that every hosting provider experienced the same attacks.
Look at the complete connection path
A website connection may pass through a CDN, reverse proxy or load balancer before reaching its origin server. Each relevant component needs to be considered. Protection at the public edge and the status of a separately reachable origin are related but distinct questions.
AWS advised operators of HTTP/2-capable servers to consult their server vendor and install applicable fixes. An ordinary website plugin update does not necessarily update the server or proxy that handles the protocol.
Practical checks for website owners
Identify who manages the public endpoint and the origin. For managed hosting, ask the responsible provider which server update or mitigation applies. For self-managed infrastructure, include the web server, proxy and externally exposed application gateways in the maintenance review.
Prepare a recovery path and check normal website behavior after any change. Availability results, request errors and resource use can help identify a regression, but they need to be interpreted together. One slow page does not establish that Rapid Reset is occurring.
The incident also demonstrated the limits of simple security labels. HTTPS does not eliminate every availability risk, and a CDN does not prove that all routes to an origin are protected. For current maintenance, follow the latest guidance for the actual products involved and confirm who owns each part of the response.
For a business that depends on online enquiries or transactions, an availability review should make responsibilities easier to act on during a disruption. Nuagerie’s cloud solutions team can help examine the hosting arrangement, identify the services and providers involved, and define the maintenance and follow-up that belong to each. The scope should reflect the business’s critical journeys and operating constraints.
Begin with a simple list of the website, any CDN or proxy provider and the person managing the origin. Existing customers reporting a problem can provide the affected address, time and observed error through the client area. Those facts support investigation; they also help distinguish a service problem from a general concern prompted by a security headline.
