HTTP/2 Rapid Reset Flaw Affects All Major Web Servers

An unknown threat actor recently launched a series of unprecedentedly large DDoS attacks against a number of cloud services and organizations, using a previously unknown weakness in the HTTP/2 protocol that allows a client to rapidly request and then cancel TCP connections in parallel, consuming vast amounts of server resources.

Beginning in late August, the attacks targeted customers of many of the large cloud service providers, including AWS, Cloudflare, and Google, and one of the attacks was three times larger …

actor attacks client cloud cloud services connections consuming ddos ddos attacks flaw http large major organizations protocol rapid rapid reset request reset resources series server servers services tcp threat threat actor vast weakness web web servers