Rapid Reset

The Rapid Reset vulnerability, officially designated as CVE-2023-44487, is a flaw in software design or implementation that allows for a unique form of Distributed Denial of Service (DDoS) attack. An attacker can exploit this vulnerability by sending a sequence of compressed HEADERS frames followed by RST_STREAM frames, thereby causing a denial of service. This method of attack has been termed "Rapid Reset." The vulnerability affects web servers with HTTP/2 capabilities, and its exploitation has led to some of the largest DDoS attacks on record, launched from relatively small botnets. These attacks have been particularly prevalent amid the Israeli conflict, with hacktivist groups on both sides launching several barrages of DDoS attacks. The Rapid Reset vulnerability came to light in October 2023 when Google and other entities disclosed its existence and potential for exploitation. In response to the revelation of this vulnerability, numerous vendors, including Microsoft, have released patches to safeguard against HTTP/2 rapid reset attacks. Despite the vulnerability, experts recommend continuing to use the HTTP/2 protocol due to its advantages over HTTP/1, suggesting disabling HTTP/2 only as a temporary mitigation strategy against Rapid Reset DDoS attacks. Microsoft, aside from addressing the Rapid Reset issue, has also released three updates to its Visual Studio development platform. These updates are separate from the company's efforts to combat the Rapid Reset vulnerability. Microsoft's response to the DDoS attacks has included strengthening layer 7 protections in their web service implementations and patching services to better protect customers from the impact of these attacks. The Health Information Sharing and Analysis Center (H-ISAC) and other ISACs have shared alerts about the vulnerability with their members, emphasizing the significant threat it poses.