HTTP/2 Zero-Day vulnerability results in record-breaking DDoS attacks
Oct 10, 2023Grant Bourzikas
Summary
This post details Cloudflare's response to a novel zero-day vulnerability in the HTTP/2 protocol, dubbed 'HTTP/2 Rapid Reset'. It describes how the vulnerability was exploited to generate hyper-volumetric DDoS attacks, including an attack exceeding 201 million requests per second. Cloudflare mitigated these attacks by developing purpose-built technology and collaborating with industry partners for responsible disclosure and patching. The post also provides recommendations for CSOs on how to protect their organizations.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack