Executive brief
A vulnerability in the HTTP/2 protocol implementation, known as 'Rapid Reset,' allows attackers to overwhelm web servers and proxies with a high volume of requests. By repeatedly opening and immediately canceling requests, an attacker can force the server to perform expensive processing tasks while bypassing standard limits on concurrent connections. This can lead to a denial-of-service (DoS) condition, making websites or applications unavailable to legitimate users.
Technical details
The vulnerability, classified as a Denial of Service (DoS), stems from the HTTP/2 protocol's handling of RST_STREAM frames. An attacker can send a request frame followed immediately by a RST_STREAM frame; because the cancellation is unilateral and does not count against the MAX_CONCURRENT_STREAMS limit, the attacker can maintain an indefinite number of requests in flight. The server still incurs the overhead of stream allocation, header decompression, and request parsing before the reset is processed, creating a significant cost asymmetry. In specific implementations like swift-nio-http2, this can exhaust the EventLoop by forcing the creation of new Channels for discarded work. Patches typically involve implementing a sliding window to rate-limit the number of stream resets allowed per connection.
Affected products
- Apple swift-nio-http2 < 1.28.0
- Akka akka-http-core < 10.5.3
- Apache tomcat-embed-core 8.5.0 to 8.5.93, 9.0.0 to 9.0.80, 10.0.0 to 10.1.13, 11.0.0-M1 to 11.0.0-M11
- Eclipse Jetty http2-server 9.3.0 to 9.4.52, 10.0.0 to 10.0.16, 11.0.0 to 11.0.16, 12.0.0 to 12.0.1
- Go net < 0.17.0
Timeline
- 2023-10-10: advisory: Original disclosure of the HTTP/2 Rapid Reset attack
- 2023-10-10: patched: swift-nio-http2 version 1.28.0 released with remediation