Listen to this Post
How the CVE Works
The vulnerability exploits malformed HTTP/2 control frames (WINDOW_UPDATE, HEADERS, PRIORITY) to force servers into resetting streams via RST_STREAM. By repeatedly sending these frames, attackers bypass SETTINGS_MAX_CONCURRENT_STREAMS, exhausting server resources. The server incorrectly decrements active stream counts upon reset, allowing unlimited concurrent streams per connection. This leads to CPU/memory exhaustion, enabling high-volume DDoS attacks. Unlike Rapid Reset (client-triggered RST_STREAM), this flaw manipulates server-side resets, evading prior mitigations.
DailyCVE Form
Platform: HTTP/2
Version: RFC 9113
Vulnerability: DDoS via RST_STREAM
Severity: Critical
Date: 2023-10-10
Prediction: Patch by 2024-Q1
What Undercode Say
Check HTTP/2 support
curl -I --http2 https://example.com
Monitor RST_STREAM frames
tcpdump -i eth0 'tcp port 443 and (tcp[((tcp[bash]>>2)+4):4] = 0x52535453)'
Mitigation snippet (rate-limiting)
if (rst_stream_count > 100/sec) { drop_connection(); }
Exploit
1. Attacker sends malformed WINDOW_UPDATE (increment=0).
- Server responds with RST_STREAM, decrementing active streams counter.
3. Repeat to exhaust resources.
Protection
- Limit server RST_STREAM rate.
- Reject invalid control frames (e.g., zero WINDOW_UPDATE).
- Enforce per-connection stream quotas.
Impact
- CPU/memory exhaustion.
- Service disruption (DDoS).
- Affects all HTTP/2-compliant servers.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
