cisco-sa-http2-reset-d8Kf32vZ

HTTP/2 Rapid Reset Attack Affecting Cisco Products: October 2023

On October 10, 2023, the following HTTP/2 protocol-level weakness, which enables a novel distributed denial of service (DDoS) attack technique, was disclosed: CVE-2023-44487: HTTP/2 Rapid Reset For a description of this vulnerability, see the following publications: How it works: The novel HTTP/2 'Rapid Reset' DDoS attack ["https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack"] (Google) HTTP/2 Zero-Day vulnerability results in record-breaking DDoS attacks ["https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/"] (Cloudflare) CVE-2023-44487 - HTTP/2 Rapid Reset Attack ["https://aws.amazon.com/security/security-bulletins/AWS-2023-011/"] (AWS)