# HTTP/2 Rapid Reset: The Zero-Day That Broke Every DDoS Record

> CVE-2023-44487 allowed attackers to generate request rates of 398 million requests per second using a fraction of the connections a normal HTTP/2 client would use.

- Category: Attack Analysis
- Author: Akarguard Team, Security Engineering
- Published: Sep 13, 2026
- Canonical: https://akarguard.net/blog/http2-rapid-reset

---

In August 2023, Google, Cloudflare and AWS simultaneously weathered the largest DDoS attacks ever recorded to that point — peaking around 398 million requests per second. The cause was not a bigger botnet but a smarter technique: a flaw in the HTTP/2 protocol now known as Rapid Reset, catalogued as CVE-2023-44487. The three companies patched in coordination before disclosing it, precisely because the technique let a small number of machines punch far above their weight.

## How Rapid Reset Works

HTTP/2 multiplexes many requests over a single TCP connection, and it lets a client cancel a request immediately with an RST_STREAM frame. Rapid Reset abuses that by sending a continuous stream of request-then-immediately-cancel pairs. The server does the expensive work of setting up and tearing down each request at an extreme rate, but the attacker never has to maintain long-lived connections — so a tiny footprint generates an enormous request rate.

> **Efficiency became the vulnerability** — A botnet of about 20,000 machines produced 398 million requests per second against Google. A comparable HTTP/1.1 attack would have needed roughly 100 times more bots. The very feature that makes HTTP/2 fast is what made the attack so cheap.

## Mitigation

- Patch your HTTP/2 implementation — every major web server has shipped a fix for CVE-2023-44487.
- Limit SETTINGS_MAX_CONCURRENT_STREAMS at the server or proxy level.
- Rate-limit RST_STREAM frames per connection so rapid cancels are throttled.
- Terminate HTTP/2 at a reverse proxy in front of your origin — Akarguard's proxy handles the HTTP/2 layer on your behalf, so an unpatched origin is shielded from the raw technique.

## The Broader Lesson

Rapid Reset was a turning point because it showed the frontier had moved from raw bandwidth to protocol cleverness — application-layer attacks that are cheap to launch and hard to distinguish from legitimate traffic. The durable defence is to terminate the transport at a reverse proxy that is independently patched and hardened, rather than exposing your origin's HTTP/2 stack directly to the internet. Akarguard does this at the edge: it terminates HTTP/2, absorbs the request/reset churn away from your origin, and applies rate limits and challenges to the request stream — while the network-layer volumetric side stays with your upstream provider. When the next protocol-level technique appears, a maintained proxy in front is what buys you time to patch.

---

Source: Akarguard Security Blog (https://akarguard.net/blog). Akarguard provides DDoS protection: traffic is proxied through our edge, attack traffic is filtered, and clean traffic reaches your origin. Reuse of this article with attribution and a link to the canonical URL is permitted.