HTTP/2 Rapid‑Reset Attack (CVE‑2023‑44487) Enables DDoS
What It Is – A flaw in the HTTP/2 protocol allows an attacker to issue a rapid series of stream‑reset frames, overwhelming the target’s connection handling logic. The issue is tracked as CVE‑2023‑44487.
Exploitability – The vulnerability can be triggered without authentication and has been demonstrated in proof‑of‑concept code; a CVSS v3.1 base score of 7.5 (High) is assigned.
Affected Products – Any server, load balancer, or library that implements the IETF HTTP/2 specification without the mitigation patches (e.g., Apache httpd 2.4.58+, Nginx 1.23+, OpenSSL‑based stacks).
Why It Matters for Trust & Control Assurance
- Availability controls – The attack directly tests the effectiveness of DDoS detection and rate‑limiting controls that organizations must evidence for audit readiness.
- Continuous monitoring – Demonstrable logging of abnormal reset traffic provides the defensible evidence auditors look for under the “availability” control objective.
- Control mapping – Mapping this vulnerability to the “ensure service continuity” control shows how a single technical gap can impact multiple compliance frameworks (NIST CSF 2.0, ISO 27001, etc.).
Recommended Actions
- Patch immediately – Apply vendor‑released updates that add reset‑rate throttling or disable the vulnerable feature.
- Enable rate limiting – Configure web servers or edge devices to limit the number of RESET frames per connection.
- Deploy DDoS monitoring – Ensure IDS/IPS and traffic‑analysis tools alert on abnormal reset spikes.
- Capture evidence – Log reset‑frame counts and retain logs for at least 90 days to support audit trails.
Source: CISA KEV – CVE‑2023‑44487