iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
HTTP/2 Rapid Reset is a denial-of-service technique in which an attacker sends a request’s HEADERS frame and immediately follows it with RST_STREAM, then repeats the sequence at high speed. The client cancels each multiplexed stream, but the gateway may already have allocated stream state, decompressed and parsed headers, performed routing, and started proxy work. That cost imbalance lets a relatively small client workload consume substantial gateway and backend CPU. Every internet-facing listener that accepts HTTP/2—including TLS terminators, CDN edges, reverse proxies, API gateways, service meshes, and application servers—needs vendor-specific patch verification and abuse controls. Disabling HTTP/2 can be a temporary contingency, but patching, stream/reset monitoring, backend protection, and upstream Layer-7 DDoS filtering are the durable response.
What is HTTP/2 Rapid Reset?
Rapid Reset abuses a normal HTTP/2 cancellation feature. HTTP/2 multiplexes many independent streams over one connection, and a client can cancel an individual stream with an RST_STREAM frame. In the attack pattern documented by Microsoft Security Response Center on October 10, 2023, the client sends HEADERS and then resets that stream immediately, without waiting for a response.
The attacker keeps the connection open and creates the next stream as soon as the previous one is canceled. Because the requests are short-lived from the client’s perspective, the connection can generate a very high request rate while avoiding the practical effect of a gateway’s normal concurrent-stream limit. The vulnerability is tracked as CVE-2023-44487.
Microsoft described the issue as a DDoS vulnerability against HTTP/2 servers and reported no evidence that the attack itself compromised customer data. Rapid Reset is therefore primarily an availability threat: degraded latency, exhausted worker capacity, overloaded upstream pools, or an outage.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
How do HEADERS and RST_STREAM frames exhaust a gateway?
The central problem is cost asymmetry. An attacker pays for a small sequence of frames, while the server may do substantial work before it can honor the reset.
- Connection and stream setup: The gateway accepts the HTTP/2 connection, tracks stream identifiers, and allocates per-stream state.
- Header processing: It receives and decompresses HTTP/2 header blocks, validates them, and constructs an HTTP request representation.
- Policy and routing: Authentication hooks, WAF rules, access checks, route matching, logging, and rate-limit lookups may run before cancellation is observed.
- Proxy activity: A reverse proxy can begin forwarding the request to an upstream application or service pool.
- Cancellation: The gateway processes
RST_STREAM, but work already performed—and work already handed to an upstream—may continue unless cancellation propagates promptly.
CERT-EU characterizes this as a server-side cost imbalance: significant parsing and request handling for little attacker effort. The nghttp2 advisory adds that rapidly creating and canceling streams without a bound can evade the intended protection of a concurrent-stream ceiling. In a reverse-proxy deployment, backend work may have started before the reset reaches the proxying layer.
Why is the effect amplified at an API gateway?
An API gateway is often the first component to terminate TLS, decode HTTP/2, apply policies, and route traffic. That makes it an efficient place for an attacker to spend server resources even when the application never receives a completed request.
Each canceled request can consume gateway CPU for HPACK decompression, header validation, route lookup, metrics, and security checks. If the gateway forwards before the reset is handled, the same burst consumes application threads, database connection slots, queue capacity, or service-mesh resources. A single public endpoint can therefore create pressure across several internal pools.
Multiplexing also changes the arithmetic. Many streams share one TCP connection, so a defense that limits connections but does not measure stream creation and reset behavior can leave the expensive work unbounded. A connection that appears to have few active streams at any instant may still be creating and canceling them continuously.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
How large was the 2023 attack activity?
The following figures are historical observations from the 2023 campaign, not a forecast or a capacity target for every service.
| Measure | Reported value | Qualification |
|---|---|---|
| Peak request rate | Just above 201 million requests per second | Cloudflare’s reported peak during the 2023 attack campaign |
| Botnet size | About 20,000 machines | Cloudflare’s estimate for the machines generating that peak |
| CVE-2023-44487 severity | CVSS 3.1 base score 7.5 (High) | National Vulnerability Database rating for a network-reachable denial-of-service vector |
| Exploitation status | Listed in CISA’s Known Exploited Vulnerabilities catalog | CISA catalog entry indicates active exploitation risk, not that every implementation is vulnerable |
The 201-million-request figure should not be reused as a universal requirement for gateway capacity. Attack impact depends on implementation, route cost, header sizes, connection distribution, backend behavior, and the controls in front of the service.
Does CVE-2023-44487 affect my API gateway?
Treat every internet-facing HTTP/2 endpoint as requiring confirmation from its vendor or maintainer. CISA’s guidance covers HTTP/2 web services broadly, while CERT-EU identified exposure across commonly deployed components such as NGINX, Apache, IIS, Kong, and other gateway and server stacks.
Check the entire protocol path, not only the application framework:
- TLS terminators and edge load balancers that negotiate HTTP/2.
- CDN or managed edge origins that accept HTTP/2 from clients or from an upstream hop.
- API gateways and reverse proxies that parse HTTP/2 and route to HTTP/1.1 or HTTP/2 backends.
- Service-mesh ingress and egress proxies.
- Application servers with public HTTP/2 listeners.
- Internal listeners that become reachable through a misconfigured load balancer or origin.
A backend can remain exposed indirectly. The gateway may allocate state, parse headers, run policy checks, and send upstream work before the application has a chance to reject the request. Record the exact product, component, build, and protocol role for each listener, then use the vendor’s CVE advisory to determine the fixed version boundary.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
What patches are required?
Apply the vendor fix for every affected HTTP/2 implementation; one product’s update does not protect a different stack. CISA recommends patching when fixes are available, and AWS advises customers who operate their own HTTP/2 servers to consult the relevant vendor and install current patches.
Free tools Windows power users keep installed
One-click scans. No signup required.
For the nghttp2 library, the advisory identifies version 1.57.0 as the patched release. That number applies to nghttp2 itself; distributions may backport the fix while retaining a different package version, so verify the operating system or platform advisory rather than relying on a version string alone.
After patching, confirm that the running process—not merely an image, package cache, or build artifact—uses the fixed code. Drain and restart instances as required by the platform, then verify protocol negotiation and error logs on each public listener.
How should I harden an API gateway against Rapid Reset?
Use layered controls. The sequence below follows the order that reduces exposure fastest while preserving HTTP/2 where possible.
- Inventory HTTP/2 exposure. List public listeners, certificates, CDN origins, load balancers, gateways, service-mesh proxies, and application servers. For each, record whether HTTP/2 is accepted from clients, from upstream peers, or both.
- Confirm and deploy vendor fixes. Map each component to its security advisory and supported fixed release. Patch edge and origin components, because an unpatched origin can still be reached directly or through a different entry point.
- Set a reasonable concurrent-stream maximum. Keep a ceiling appropriate to the application’s normal multiplexing needs. This is a baseline guardrail, not a complete Rapid Reset defense, because rapid creation and cancellation can avoid a sustained high count of active streams.
- Measure reset behavior over time. Track
RST_STREAMcounts, stream creations, connection age, and reset-to-request ratios per connection and source identity. A short burst may be normal; sustained high churn is a signal for enforcement. - Enforce an abuse action. Depending on the gateway, throttle the connection, close it, or send
GOAWAYbefore terminating it. Apply thresholds over a time window so that an attacker cannot evade controls by keeping the instantaneous count low. - Protect expensive routes. Rate-limit authentication, search, upload, report-generation, and other costly endpoints separately from cheap health checks. Keep limits at the edge where possible so rejected work does not consume application capacity.
- Isolate gateway workers and upstream pools. Reserve capacity for ordinary traffic and prevent one listener or tenant from consuming every worker, queue, or connection slot. This limits blast radius when a reset burst reaches routing or proxy stages.
- Propagate cancellation promptly. Ensure that a reset closes or cancels the corresponding upstream request, task, stream, and timer. Review retries and queue behavior; otherwise a canceled client stream can leave work running in the backend.
- Add upstream Layer-7 DDoS or WAF protection. A managed protection layer can absorb or filter abusive HTTP traffic before it reaches self-managed gateways. Confirm what HTTP/2 telemetry and reset-rate controls the provider exposes, and test the fail-open or fail-closed behavior.
- Exercise the controls safely. In a staging environment, generate representative stream churn with an approved test tool, verify that alerts fire, confirm that abusive connections receive the intended action, and check that legitimate multiplexed clients remain usable.
Should I disable HTTP/2?
Disabling HTTP/2 is a contingency, not the preferred permanent fix. CERT-EU lists disabling HTTP/2 or HTTP/3 as a last resort because it can reduce performance and break compatibility for clients, intermediaries, or APIs that depend on multiplexing and modern protocol negotiation.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Use it when a vulnerable component cannot be patched promptly, when abuse controls are unavailable, or when active traffic is exhausting capacity. Apply the change at every relevant termination point, communicate the compatibility impact, and keep monitoring for HTTP/1.1-specific load changes. Re-enable HTTP/2 only after the affected components are patched and reset-abuse controls are validated.
How can I compare gateway and protection options?
Product names alone do not show whether a deployment is protected. Ask vendors and operators for concrete behavior on the following dimensions.
| Decision axis | Questions to ask |
|---|---|
| Fix coverage | Was CVE-2023-44487 fixed, and what exact supported version or backported package contains the fix? |
| Stream accounting | Are concurrent streams, stream-creation rates, and RST_STREAM rates measured per connection, identity, route, and time window? |
| Enforcement | Does the system throttle, reset, or close abusive connections, and can it issue GOAWAY with an auditable reason? |
| Cancellation path | Does a client reset cancel upstream work before it is committed to an application, queue, database, or retry loop? |
| Layer-7 location | Where is DDoS/WAF filtering performed, and can operators see protocol, connection, stream, and reset telemetry? |
| Fallback impact | What performance, client-compatibility, and operational costs result if HTTP/2 must be disabled temporarily? |
Require evidence in a test environment: dashboards that show stream churn, alerts tied to thresholds, and traces proving that a reset reaches the upstream cancellation path. A control that exists only in documentation but cannot be observed during an incident is difficult to operate reliably.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should operators monitor during an incident?
Look for a sudden rise in new streams per connection, resets arriving immediately after headers, CPU growth at the HTTP/2 termination tier, and upstream work that outlasts client connections. Compare these signals with normal traffic by route and tenant so that a legitimate high-concurrency client is not blocked solely for using HTTP/2 effectively.
Recommended Free Tools
Preserve connection-level and stream-level telemetry: negotiated protocol, listener, timestamps, stream identifiers, header-processing errors, reset counts, enforcement actions, and whether an upstream request was started or canceled. Correlate gateway data with backend queue depth, worker utilization, and database pressure. This identifies whether the bottleneck is parsing, policy processing, proxying, or an upstream dependency.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
During active abuse, prioritize capacity for authenticated or business-critical routes, tighten reset-rate actions on clearly abusive connections, and coordinate edge filtering with gateway changes. Afterward, review thresholds, cancellation propagation, and any direct-to-origin path that allowed traffic to bypass the intended protection layer.
Frequently Asked Questions
Can an HTTP/1.1 client perform the same Rapid Reset attack?
The named Rapid Reset technique relies on HTTP/2 frame behavior—especially the immediate HEADERS followed by RST_STREAM sequence. HTTP/1.1 has different connection and request-cancellation semantics, although it can still be used for other forms of application-layer or connection-exhaustion attacks.
Does a high reset count always mean an attack?
No. Browsers, mobile clients, and service-to-service callers can legitimately cancel streams when users navigate away, deadlines expire, or competing requests finish first. Use a time window, route context, source identity, and reset-to-header ratio rather than a single absolute count.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Can a patched gateway still overload its backend during resets?
Yes, if the gateway fix prevents the protocol-level denial of service but cancellation is not propagated to upstream work. Verify separately that reset requests release proxy tasks, retries, queues, and application operations promptly.
Is Rapid Reset evidence that customer data was stolen?
No. Microsoft reported no evidence that the attack itself compromised customer data. It is an availability vulnerability, so investigate confidentiality or integrity incidents separately instead of inferring data theft from elevated reset traffic.
What should I record before changing HTTP/2 settings?
Capture current client protocol usage, negotiated versions, stream concurrency, reset rates, latency, error rates, and backend utilization. This baseline lets you quantify the compatibility and performance effect of a temporary HTTP/2 shutdown and identify clients that need an alternate path.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
