CVE-2023-44487: Rapid Reset on HTTP/2 (CVSS 7.5)

CVE-2023-44487 describes a vulnerability in the HTTP/2 protocol enabling denial-of-service attacks through rapid stream cancellation, a phenomenon known as Rapid Reset. Attackers send HTTP/2 requests and cancel them in quick succession, consuming server resources and exhausting connection pools, causing service degradation for legitimate users. This vulnerability was actively exploited in production environments between August and October 2023 against infrastructure operated by providers and enterprises.

CVE-2023-44487 carries a CVSS score of 7.5 (high) with declared impact rated as "high". The vulnerability became public on 10 October 2023. Signals of continued technical interest persist: as of November 2026, a public repository models HTTP/2 behavior against Rapid Reset attacks for academic research purposes, confirming the vulnerability's ongoing relevance in infrastructure security assessments.

IT teams and system administrators must verify that all HTTP/2 servers and reverse proxies deployed in production have received security patches released by vendors between October and November 2023. Patches implement stream reset rate limiting and back-off mechanisms. It is critical to review versions of nginx, Apache, OpenLiteSpeed, HAProxy, Go, Rust, Node.js and other web server runtimes against 2023 security bulletins. Organizations must also ensure HTTP/2 flow monitoring is configured to detect rapid reset anomalies as indicators of ongoing attacks.