On 10 October 2023 Google, Cloudflare and AWS jointly disclosed CVE-2023-44487, named HTTP/2 Rapid Reset, alongside CISA guidance. The technique exploits stream multiplexing: a client may open many concurrent requests and cancel them unilaterally, and cancellation costs the client almost nothing while the server has already begun work.
Reported peaks were 398 million requests per second at Google, 201 million at Cloudflare and 155 million at AWS. Exploitation was reported from August through October 2023, before disclosure. Any server implementing HTTP/2 was potentially affected.
You Cannot Patch A Specification
Almost every exploitation file in this corpus names a vendor and a version. Here the defect is in how the protocol defines stream cancellation, so there is no upstream to fix it and no single patch to apply.
Each implementation had to add limits the specification does not require, independently, at its own pace. We filed the nearest equivalents at 26-0727 and 26-0729, where the exposed thing was a class of industrial controller rather than one product. Both are cases where the remediation is a coordination problem rather than an update.
The Asymmetry Is The Weapon
A denial-of-service technique is interesting when the cost to attack is far below the cost to absorb. Cancelling a stream is nearly free for the client and expensive for the server, which is the whole mechanism.
This corpus mostly records confidentiality incidents because those are what disclosure regimes produce paperwork about. It argues at 24-1231 and 22-0224 that availability harm goes unrecorded, and Rapid Reset is the purest case: enormous attacks, absorbed by three companies with the capacity to absorb them, generating no notification to anyone.
Two Months Of Quiet Exploitation
Attacks ran from August. Disclosure came in October, coordinated between the largest providers so that mitigations were available when the technique became public.
The desk records the interval without criticising it — coordinated disclosure of a protocol flaw with no patch pipeline is a genuinely hard problem, and 22-0930 shows what an uncoordinated interim mitigation looks like. But everyone outside the coordination was undefended for two months and did not know it, which is the same asymmetry filed at 22-0527.
Built on the coordinated disclosures from Google, Cloudflare and AWS, CISA’s alert, and vendor analyses. The 10 October 2023 disclosure, the mechanism of unilateral stream cancellation under HTTP/2 multiplexing, the reported peak request rates at each provider, the August–October exploitation window and the breadth of affected implementations are as reported. The characterisation of the attacks as the largest recorded at the time reflects the providers’ own statements. No attack tooling, proof of concept or indicator is reproduced. No actor is named — none was authoritatively identified. Graded high. Corrections: corrections@forensicpost.com.