Alert

HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487

Release Date

Researchers and vendors have disclosed a denial-of-service (DoS) vulnerability in HTTP/2 protocol. The vulnerability (CVE-2023-44487), known as Rapid Reset, has been exploited in the wild in August 2023 through October 2023.

CISA recommends organizations that provide HTTP/2 services apply patches when available and consider configuration changes and other mitigations discussed in the references below. For more information on Rapid Reset, see:

Organizations can take proactive steps to reduce the effects of DoS attacks. See the following guidance for more information:

This product is provided subject to this Notification and this Privacy & Use policy.