HTTP/2 rapid reset attack impacting Nginx products
1–10 of 66 posts
Re: HTTP/2 rapid reset attack impacting Nginx products
#2Related. Others?
HAProxy is not affected by the HTTP/2 Rapid Reset Attack - https://news.ycombinator.com/item?id=37837043 - Oct 2023 (31 comments)
The largest DDoS attack to date, peaking above 398M rps - https://news.ycombinator.com/item?id=37831062 - Oct 2023 (461 comments)
HTTP/2 Rapid Reset: deconstructing the record-breaking attack - https://news.ycombinator.com/item?id=37831004 - Oct 2023 (22 comments)
HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks - https://news.ycombinator.com/item?id=37830998 - Oct 2023 (69 comments)
The novel HTTP/2 'Rapid Reset' DDoS attack - https://news.ycombinator.com/item?id=37830987 - Oct 2023 (103 comments)
Re: HTTP/2 rapid reset attack impacting Nginx products
#3Related. Others? HAProxy is not affected by the HTTP/2 Rapid Reset Attack - https://news.ycombinator.com/item?id=37837043 - Oct 2023 (31 comments) The largest DDoS attack to date, peaking above 398M rps - https://news.ycombinator.com/item?id=37831062 - Oct 2023 (461 comments) HTTP/2 Rapid Reset: deconstructing the record-breaking attack - https://news.ycombinator.com/item?id=37831004 - Oct 2023 (22 comments) HTTP/2 z…
Thanks for the helpful summary. It does wonder to provide context to such an important topic.
Re: HTTP/2 rapid reset attack impacting Nginx products
#4Related. Others? HAProxy is not affected by the HTTP/2 Rapid Reset Attack - https://news.ycombinator.com/item?id=37837043 - Oct 2023 (31 comments) The largest DDoS attack to date, peaking above 398M rps - https://news.ycombinator.com/item?id=37831062 - Oct 2023 (461 comments) HTTP/2 Rapid Reset: deconstructing the record-breaking attack - https://news.ycombinator.com/item?id=37831004 - Oct 2023 (22 comments) HTTP/2 z…
It's been interesting to see who is affected and who isn't and their rationale.
Re: HTTP/2 rapid reset attack impacting Nginx products
#5Hehe, when I heard about the attack a couple of days ago I was interested to know if Nginx was affected and did a search on Google for the CVE of that attack followed by the name of Nginx.
I didn’t find anything relevant so I assumed that Nginx was not affected.
Turns out that was not a good assumption :p
Re: HTTP/2 rapid reset attack impacting Nginx products
#6Hehe, when I heard about the attack a couple of days ago I was interested to know if Nginx was affected and did a search on Google for the CVE of that attack followed by the name of Nginx. I didn’t find anything relevant so I assumed that Nginx was not affected. Turns out that was not a good assumption :p
If you read the article, you'll see that the default configuration is not affected.
Re: HTTP/2 rapid reset attack impacting Nginx products
#7Hehe, when I heard about the attack a couple of days ago I was interested to know if Nginx was affected and did a search on Google for the CVE of that attack followed by the name of Nginx. I didn’t find anything relevant so I assumed that Nginx was not affected. Turns out that was not a good assumption :p
[deleted]
Re: HTTP/2 rapid reset attack impacting Nginx products
#8Important to note that unless your Nginx instance has a special (read: very high) keepalive limit configured, Nginx has a fairly reasonable defense against HTTP/2 rapid reset attack by default, as the article says. Still, interesting to see the response to these attacks.
Re: HTTP/2 rapid reset attack impacting Nginx products
#9Hehe, when I heard about the attack a couple of days ago I was interested to know if Nginx was affected and did a search on Google for the CVE of that attack followed by the name of Nginx. I didn’t find anything relevant so I assumed that Nginx was not affected. Turns out that was not a good assumption :p
If you read the article, you'll see that the default configuration is not affected.
I know. But not everyone uses the default configuration.
Re: HTTP/2 rapid reset attack impacting Nginx products
#10Why the submission OP?
Lots of discussion and submissions related to this over the last few days, not to mention this submitted 2 days ago