In August 2023, Google, Cloudflare and AWS simultaneously weathered the largest DDoS attacks ever recorded to that point — peaking around 398 million requests per second. The cause was not a bigger botnet but a smarter technique: a flaw in the HTTP/2 protocol now known as Rapid Reset, catalogued as CVE-2023-44487. The three companies patched in coordination before disclosing it, precisely because the technique let a small number of machines punch far above their weight.
How Rapid Reset Works
HTTP/2 multiplexes many requests over a single TCP connection, and it lets a client cancel a request immediately with an RST_STREAM frame. Rapid Reset abuses that by sending a continuous stream of request-then-immediately-cancel pairs. The server does the expensive work of setting up and tearing down each request at an extreme rate, but the attacker never has to maintain long-lived connections — so a tiny footprint generates an enormous request rate.
Efficiency became the vulnerability
A botnet of about 20,000 machines produced 398 million requests per second against Google. A comparable HTTP/1.1 attack would have needed roughly 100 times more bots. The very feature that makes HTTP/2 fast is what made the attack so cheap.
Mitigation
- Patch your HTTP/2 implementation — every major web server has shipped a fix for CVE-2023-44487.
- Limit SETTINGS_MAX_CONCURRENT_STREAMS at the server or proxy level.
- Rate-limit RST_STREAM frames per connection so rapid cancels are throttled.
- Terminate HTTP/2 at a reverse proxy in front of your origin — Akarguard's proxy handles the HTTP/2 layer on your behalf, so an unpatched origin is shielded from the raw technique.
The Broader Lesson
Rapid Reset was a turning point because it showed the frontier had moved from raw bandwidth to protocol cleverness — application-layer attacks that are cheap to launch and hard to distinguish from legitimate traffic. The durable defence is to terminate the transport at a reverse proxy that is independently patched and hardened, rather than exposing your origin's HTTP/2 stack directly to the internet. Akarguard does this at the edge: it terminates HTTP/2, absorbs the request/reset churn away from your origin, and applies rate limits and challenges to the request stream — while the network-layer volumetric side stays with your upstream provider. When the next protocol-level technique appears, a maintained proxy in front is what buys you time to patch.