HTTP/2 Zero-Day Powers the Largest DDoS Attacks Ever Recorded

Cloudflare, Google, and Amazon AWS have jointly disclosed a zero-day vulnerability in the HTTP/2 protocol that attackers have been exploiting to launch unprecedented, hyper-volumetric distributed denial-of-service (DDoS) attacks. Dubbed “HTTP/2 Rapid Reset,” the flaw has enabled a single attack to reach an astonishing 201 million requests per second (rps)—three times larger than any previously observed attack. Cloudflare reports mitigating over 1,100 attacks exceeding 10 million rps since late August 2023, with 184 of those surpassing the company's prior DDoS record of 71 million rps.

Breaking Down the Rapid Reset Attack

The vulnerability targets HTTP/2's stream cancellation feature. Attackers send a request and immediately cancel it, repeating this "request, cancel" cycle at massive scale. This trivial pattern, when automated, can take down any server running a standard HTTP/2 implementation. What makes this particularly alarming is the botnet size required: the record-breaking 201 million rps attack was launched by a modest botnet of roughly 20,000 machines. Cloudflare regularly detects botnets orders of magnitude larger—hundreds of thousands or even millions of machines—making the attack's efficiency a stark demonstration of the protocol's fragility.

During the initial wave of attacks, Cloudflare experienced intermittent edge instability. While most incoming traffic was mitigated, the load overloaded certain network components, resulting in intermittent 4xx and 5xx errors for a small number of customers. These issues were quickly resolved.

Coordinated Industry Response

Cloudflare followed a responsible disclosure process, working with industry peers before publicizing the vulnerability. The company notes that no "perfect disclosure" exists; organizations must adopt an assume-breach mindset given the constant emergence of new zero-days and evolving threat actors. Cloudflare's engineering team developed purpose-built technology to stop these attacks and improve mitigation capabilities for future incidents of similar scale.

The company has also alerted web server software vendors, who are developing patches. Cloudflare states that customers using its HTTP DDoS mitigation services are protected.

Why Attackers Targeted Cloudflare First

Cloudflare's early exposure to these attacks may seem counterintuitive—why target a company with some of the strongest DDoS defenses in the industry? The likely explanation is testing. Threat actors need to calibrate large-scale attack tools but often lack the infrastructure to absorb the traffic they generate. Cloudflare's public network performance charts provided the threat actor with a way to measure the exploit's effectiveness. This early visibility, while disruptive, allowed Cloudflare to develop and refine mitigations before the technique was turned against less-protected targets.

Immediate Actions for Security Leaders

The disclosure marks the point at which threat actors become widely aware of the vulnerability, triggering a race between patching and exploitation. Organizations should assume their systems will be tested. The situation is comparable to the Log4J vulnerability in that new variants are likely to emerge as researchers and attackers experiment with the flaw, potentially yielding shorter exploit cycles and more advanced bypasses. Patching is not a one-time task; incident management and security hardening must be ongoing processes.

For CSOs and security teams, the recommended steps include:

  • Map external connectivity across your network and identify Internet-facing systems that require immediate mitigation.
  • Review existing security protections for detection and response gaps, fixing any issues without delay.
  • Deploy DDoS protection outside your data center—traffic that reaches your infrastructure is far harder to stop.
  • Ensure Layer 7 DDoS protection, Web Application Firewalls, DNS protection, Layer 3 network traffic protection, and API Firewalls are in place.
  • Apply web server and operating system patches across all Internet-facing servers. Verify that automation tooling such as Terraform builds and images are fully patched to prevent outdated server versions from being deployed.
  • As a last resort, consider disabling HTTP/2 and HTTP/3 (likely also vulnerable) to mitigate the threat. This is only a final measure due to the significant performance impact of downgrading to HTTP/1.1.
  • Consider a secondary cloud-based Layer 7 DDoS provider at your perimeter for additional resilience.

Cloudflare has made its DDoS capabilities available free of charge to organizations concerned about their current protections. Full technical details of the vulnerability are available in Cloudflare's separate technical breakdown of the attack.