Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
HTTP/2 Rapid Reset is a denial-of-service technique that pairs each request’s HEADERS frame with an immediate RST_STREAM cancellation. The attacker can repeat that sequence on a small number of persistent connections without waiting for responses. A gateway may still allocate stream state, decompress and route headers, and start upstream work before it processes the reset, so the server and backend spend far more resources than the attacker does. Every internet-facing HTTP/2 listener—CDN edge, TLS terminator, load balancer, reverse proxy, API gateway or application server—should therefore be checked with its vendor, patched where a fix exists, monitored for abnormal reset behavior and protected upstream. Disabling HTTP/2 can reduce exposure temporarily, but it is a last-resort contingency because it affects compatibility and performance.
What is HTTP/2 Rapid Reset?
Rapid Reset is an abuse of HTTP/2 stream cancellation, tracked as CVE-2023-44487. HTTP/2 multiplexes many independent streams over one connection. A client normally opens a stream, sends request headers, receives a response and eventually closes the stream. The protocol also allows the client to cancel an individual stream with an RST_STREAM frame.
As an Amazon Associate I earn from qualifying purchases.
The attack removes the waiting step. The client sends HEADERS to make the server begin processing a request, then immediately sends RST_STREAM. It repeats that pair as quickly as possible, often keeping the connection open. Microsoft Security Response Center described the pattern as “HEADERS followed by RST_STREAM” and said that packing these frames onto one connection can create high request rates and CPU utilization.
The reset is not a guarantee that all work disappears. Depending on the implementation, the server may have already allocated stream state, decompressed and parsed headers, selected a route, authenticated part of the request, or sent work to an upstream service. The attacker pays for a small amount of connection and frame traffic while the gateway performs comparatively expensive processing. That cost asymmetry is what turns a protocol feature into an amplification mechanism against API infrastructure.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Rapid Reset is a denial-of-service attack, not a data-theft technique. Microsoft reported no evidence that the attack itself compromised customer data. Its purpose is to consume CPU, connection-handling capacity, worker time and, in proxy deployments, backend capacity.
How do HEADERS and RST_STREAM frames exhaust an API gateway?
The damaging sequence has four stages: create a stream, make the gateway do useful work, cancel the stream, and immediately create another one. Multiplexing lets the attacker perform this sequence concurrently without opening a new TCP connection for every request.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 111. The client creates apparent request work
A HEADERS frame carries the HTTP method, path and other request metadata. The gateway must receive and decode it, maintain stream state and decide which listener, policy or upstream route applies. Header compression reduces wire overhead, but it does not remove the server-side parsing and policy work.
2. Cancellation arrives after processing has started
RST_STREAM tells the server that the client no longer wants the stream. Implementations cannot always roll back work that has already passed through parsing, routing or application dispatch. A reverse proxy may have forwarded a request to a backend before the reset is observed, leaving the backend to finish or unwind work that the client never intended to receive.
3. The normal concurrent-stream limit is evaded
HTTP/2 servers commonly advertise a maximum number of concurrent streams. Rapid Reset exploits the gap between “streams currently active” and “streams created over time.” If each stream is cancelled quickly, the attacker can keep the number of simultaneously open streams below the advertised ceiling while creating and processing a much larger number of streams during the connection’s lifetime. The nghttp2 advisory specifically warns that rapidly creating and cancelling streams without bound can avoid the normal concurrent-stream protection.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
4. A gateway can amplify pressure toward backends
An API gateway is often the first component to parse headers, apply authentication or routing rules and contact a service pool. If cancellation is not propagated promptly, upstream work continues after the client has reset its stream. That makes the gateway an amplifier: the edge connection carries inexpensive frame pairs, while gateway workers and backend services perform more costly operations.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsHow large can a Rapid Reset attack be?
Public incident reporting shows the technique can reach extraordinary aggregate rates, but historical observations are not a capacity forecast for every deployment.
| Measure | Reported value | Context |
|---|---|---|
| Peak request rate | Just above 201 million requests per second | Cloudflare’s report of the 2023 attack campaign |
| Attacking machines | About 20,000 | Cloudflare’s estimate for the botnet behind that peak |
| CVSS 3.1 base score | 7.5 (High) | National Vulnerability Database rating for CVE-2023-44487, a network-reachable denial-of-service vector |
| nghttp2 patched release | 1.57.0 | Version identified by the nghttp2 security advisory |
The National Vulnerability Database also lists CVE-2023-44487 in CISA’s Known Exploited Vulnerabilities catalog. The figures above describe the 2023 campaign and its published assessment; they should not be reused as a universal requests-per-second requirement or as a prediction of current attack volume.
Does CVE-2023-44487 affect my API gateway?
Assume an internet-facing HTTP/2 endpoint requires vendor confirmation until its maintainer says otherwise. Exposure is determined by the HTTP/2 implementation and the way the gateway handles streams, not by whether the application behind it ever receives a completed request.
Components that belong in the inventory
- Public HTTPS listeners that negotiate HTTP/2 through ALPN.
- CDN edges and the origins they connect to.
- TLS terminators, load balancers and reverse proxies.
- API gateways and gateway plug-ins that parse or route HTTP/2 requests.
- Service-mesh ingress and egress proxies.
- Application servers that accept HTTP/2 directly.
CISA treats HTTP/2 web services broadly in its guidance. CERT-EU identifies affected product and component families including NGINX, Apache, IIS, Kong and other gateway or server stacks. Those names indicate where to check, not a claim that one generic patch covers every release or configuration. Confirm the exact product, edition, build and vendor advisory for each listener.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
What should operators do first?
Use a staged response: discover every HTTP/2 termination point, install the correct vendor fix, add behavioral controls, protect upstream services and reserve protocol disablement for an emergency fallback.
- Inventory HTTP/2 exposure. Record every public hostname, IP, port and listener that negotiates HTTP/2. Include CDN origins, cloud load balancers, API gateways, reverse proxies and service-mesh ingress. Map each listener to its software version and to the backend pools it can reach.
- Apply the vendor’s fix. Check the security advisory for each implementation and move to the supported release that addresses CVE-2023-44487. CISA recommends patching when fixes are available, and AWS tells customers who operate their own HTTP/2 servers to consult the relevant vendor and install current patches. For nghttp2, the advisory identifies version 1.57.0 as the patched release. Do not infer that this version protects a different HTTP/2 stack.
- Set stream and reset controls. Keep a reasonable maximum concurrent-stream value, but do not rely on that ceiling alone. Measure stream creations, cancellations and connection age over a time window. When a connection exceeds an abuse threshold, throttle it, close it or send
GOAWAYaccording to the product’s documented behavior. A useful control must account for streams that were created and reset, not only streams still open at the instant of measurement. - Protect expensive routes and workers. Apply stricter rate limits to routes that trigger costly authentication, searches, fan-out calls or writes. Isolate gateway worker pools where possible so one abusive HTTP/2 connection cannot consume all request-processing capacity. Set bounded timeouts and queues for upstream calls.
- Propagate cancellation promptly. Verify that a reset stream cancels or marks its upstream request as cancelled before more backend work is committed. Instrument the hand-off so operators can see whether the gateway receives
RST_STREAMbefore dispatch, during dispatch or after the upstream call has started. - Place Layer-7 DDoS protection upstream. A managed DDoS or WAF layer can absorb or filter abusive HTTP traffic before it reaches self-managed gateways. AWS and Cloudflare describe provider-side mitigations, while CERT-EU recommends DDoS-protection mechanisms. Confirm which HTTP/2 controls the service actually enforces and what connection-level telemetry it exports.
- Use protocol disablement only as a contingency. If a vulnerable endpoint cannot be patched or adequately shielded during an incident, temporarily disable HTTP/2 at the exposed listener or upstream edge. CERT-EU lists disabling HTTP/2 or HTTP/3 as a last resort because clients may fall back differently and performance or compatibility can suffer. Treat the change as an incident control, then restore HTTP/2 after the fixed implementation and monitoring are in place.
Which controls matter most at an API gateway?
No single setting is sufficient. Compare a gateway or protection design using the point where it acts, the signal it measures and the work it prevents.
| Control or decision | What to verify | Main trade-off |
|---|---|---|
| Vendor remediation | The supplier explicitly fixes CVE-2023-44487 and documents the supported version boundary. | Upgrade sequencing, compatibility testing and maintenance windows are required. |
| Stream and reset enforcement | Counts include rapidly created and cancelled streams, not only currently open streams. | Aggressive thresholds can terminate legitimate clients with high cancellation rates. |
| Connection response | The product can throttle, close or issue GOAWAY when abuse thresholds are exceeded. |
Each action has different effects on client reconnection and observability. |
| Cancellation propagation | Upstream work stops or is bounded when the client resets the HTTP/2 stream. | Propagation depends on gateway, runtime and backend support. |
| Layer-7 DDoS/WAF placement | Filtering occurs before traffic reaches the self-managed gateway, with usable telemetry for operators. | Managed protection adds service dependency and operational cost. |
| HTTP/2 disablement | Fallback behavior for clients and intermediaries is understood and tested. | Compatibility and performance can degrade, so it is a contingency rather than a normal fix. |
How can teams detect Rapid Reset behavior?
Look for relationships between stream creation and cancellation, not just a high request count. A connection that repeatedly sends headers and resets streams before responses, especially while remaining below the configured concurrent-stream limit, is more suspicious than a client that opens a few long-lived streams.
- Track
HEADERS, stream creation andRST_STREAMcounts per connection and per source identity. - Measure the ratio of reset streams to completed responses over rolling time windows.
- Record connection age, negotiated protocol, concurrent-stream levels and whether a
GOAWAYor forced close was sent. - Correlate gateway resets with upstream calls, queue depth, worker utilization and backend cancellation outcomes.
- Alert on sudden increases in reset frequency or CPU usage even when ordinary application request metrics look normal.
Do not treat one threshold as universal. Normal clients, mobile networks and intermediaries can cancel requests for legitimate reasons. Baselines should be established per endpoint and client population, then combined with connection-level behavior and backend impact.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What are the common mitigation mistakes?
Relying only on the concurrent-stream limit
A limit on streams open at one moment does not stop a client from creating and cancelling streams in rapid succession. Add a rate or rolling-window control for stream creation and resets.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Patching only the application server
The first HTTP/2 component to consume resources may be a CDN edge, TLS terminator, load balancer or gateway. Patch and assess every termination point, including components that sit in front of the application.
Assuming a reset cancels backend work
Reverse proxies can dispatch upstream work before processing RST_STREAM. Verify cancellation behavior with the exact gateway and backend versions in production, and bound the cost of routes that fan out.
Turning off HTTP/2 without a compatibility plan
Disabling the protocol can change client negotiation, latency and connection behavior. Use it as a controlled emergency measure, communicate the expected fallback and remove it after remediation.
Using historical attack figures as a sizing formula
The 201-million-requests-per-second figure was Cloudflare’s observation of a particular 2023 campaign generated by roughly 20,000 machines. It is evidence of possible scale, not a universal capacity target for every API.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What does a defensible remediation plan look like?
Within the first response window, identify all HTTP/2 listeners and their owners, freeze unverified configuration changes, and check each vendor advisory. Next, deploy the supported fixes or place an upstream protection layer in front of unpatched listeners. During and after deployment, watch reset ratios, CPU, queue depth, upstream cancellation and error rates, then test the connection response to abusive patterns in a controlled environment.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Document the exact version that was installed, the stream and reset thresholds, the action taken at each threshold and the rollback path. Recheck the inventory after infrastructure changes; a newly introduced load balancer or service-mesh ingress can create another HTTP/2 termination point. Because provider controls and patch boundaries change over time, keep the vendor confirmation attached to the asset record rather than treating CVE-2023-44487 as a one-time checklist item.
Frequently Asked Questions
Is Rapid Reset a data-breach vulnerability?
No. It is classified as a network-reachable denial-of-service vulnerability. The attack’s documented effect is resource exhaustion; Microsoft reported no evidence that the attack itself compromised customer data.
Can a patched gateway still be affected by an HTTP/2 flood?
Yes, a patch addresses the vulnerable handling behavior but does not create unlimited CPU, bandwidth or backend capacity. A patched gateway still benefits from sensible route limits, connection monitoring and upstream DDoS capacity for large or distributed floods.
What should an incident dashboard show during a suspected attack?
Show per-connection stream creations, resets, completed responses, connection age and negotiated protocol alongside CPU and worker saturation. Add upstream-call counts and cancellation outcomes so responders can see whether the gateway is forwarding work after clients reset streams.
Why is a reset-rate threshold harder than a request-rate limit?
Legitimate clients can cancel requests because users navigate away, networks change or timeouts fire. A useful threshold therefore considers cancellation frequency over time, the ratio of resets to completed responses, connection behavior and backend impact instead of rejecting every client with a few resets.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
