On October 10, 2023, Cloudflare, Google, and AWS disclosed—almost simultaneously—an attack method that had been plaguing the internet for weeks: HTTP/2 Rapid Reset (CVE-2023-44487). It didn't rely on a botnet's "human-wave tactic"; instead it abused a design feature of the HTTP/2 protocol itself to unleash application-layer (L7) floods peaking at 398 million requests per second (RPS). This article breaks it down across three layers—protocol, data, and defense—so you fully understand the event widely called the one that "reshaped the L7 DDoS battlefield."

1. How it wins with a small force

One of HTTP/2's headline improvements is multiplexing: a single TCP connection can open many concurrent "streams." Rapid Reset abuses the stream lifecycle—specifically the RST_STREAM frame.

The attacker's playbook is brutally simple: on each stream, send a request (HEADERS frame), immediately send RST_STREAM to cancel it, then open the next. Repeat the "request–cancel–request–cancel" loop at high speed. Even though the request is canceled, the server has already allocated memory, performed HPACK decompression, route lookup, and initialization for that stream—costs it only reclaims afterward.

This is a war of computational asymmetry: the attacker pays only ~20–30 bytes per round (9-byte HEADERS + 13-byte RST_STREAM), while the server pays thousands of bytes of CPU and memory work per round. With minimal bandwidth, the server's CPU is exhausted first.

Cloudflare's numbers are telling: a botnet of just 20,000 nodes, each looping ~10,000 times per second, generated 200 million RPS. Compare that to traditional IoT botnets with hundreds of thousands or millions of devices that often only manage a few million RPS. Rapid Reset boosted per-node attack power by orders of magnitude.

2. Real scale: the three giants' measurements

  • Google: peak 398 million RPS—more than 7× the previous largest attack in internet history.
  • Cloudflare: peak 201 million RPS—3× the February 2023 record of 71 million RPS.
  • AWS: a dozen-plus attacks over two days, largest at 155 million RPS.

Crucially, this exploits a design flaw present in virtually every HTTP/2 implementation: Nginx, Apache HTTP Server, Apache Tomcat, Microsoft IIS, HAProxy, Envoy, gRPC, Node.js, Go net/http, and .NET Kestrel all required patches. The coordinated disclosure on Oct 10, 2023 was called "one of the largest synchronized patching events in internet history," and CISA issued advisory AA23-283A.

3. Why traditional defenses fail here

  1. Logs can't see the attack: RST_STREAM cancels the request before the server produces a response, so access logs often don't record these "unfinished" requests. Your logs look clean while the server is being crushed.
  2. Completion-based rate limiting doesn't trigger: classic rate limiting counts completed requests; Rapid Reset requests are canceled before completion, so the limits never fire.
  3. Volumetric mitigations are useless: this isn't a volumetric attack—the bottleneck is CPU, not bandwidth. "Buy a bigger pipe" does nothing.

4. The 2024 long tail: edges patched, internals exposed

Many assumed patching was the end. But through the first half of 2024, financial and fintech firms kept getting targeted, with individual banks and processors peaking at 50–100 million RPS, causing API gateway failures, transaction timeouts, and mobile-banking outages. The root cause: organizations patched their edge reverse proxies but left internal load balancers and legacy middleware running unpatched HTTP/2 implementations—the vulnerability's "long tail" remained exploitable months after disclosure.

5. A defense checklist for engineers

  • Monitor frame-level metrics, not request counts: the key signal is the ratio of RST_STREAM to completed responses. Normally RST_STREAM should be under 1% of stream closures; a spike is a strong attack indicator.
  • Enforce per-connection stream caps and RST rate limits at the edge.
  • Upgrade every HTTP/2 component: Nginx 1.25.3+, Apache 2.4.58+, Node.js 18.18.2+/20.8.1+, Go 1.21.3+, HAProxy 2.8.4+, etc.
  • For L7, behavioral analysis beats static rules: detect the anomaly of "high cancel rate, low completion rate" against a behavioral baseline rather than bluntly blocking IPs.

Conclusion

Rapid Reset marks a paradigm shift in L7 DDoS: attackers no longer rely on bandwidth supremacy but exploit protocol design flaws for computational asymmetry—small force, large effect. For any organization serving HTTP on the public internet, it's a wake-up call: what you assume is "normal protocol behavior" may be someone else's weapon. For defenders, the real answer is an architecture that does frame-level identification and autonomous mitigation at the protocol edge.