HTTP/2 Rapid Reset is a denial-of-service vulnerability in HTTP/2 cancellation handling. An attacker opens many TCP connections, sends a request, and cancels it immediately; if the server retains the canceled connections, the attacker can overwhelm the API. section 5.1.1
Canceled requests that bypass concurrency limits
Imagine a public API limiting each client to a fixed number of concurrent requests. An attacker repeatedly starts a request and cancels it before completion. If cancellation does not close the underlying connection, the attacker can create far more active connections than the configured request limit, consuming server capacity. The attack reached hundreds of millions of requests per second at its peak. section 5.1.1
Reduce exposure with practical operational controls:
- Place public APIs behind a cloud service with built-in denial-of-service mitigation, such as Cloudflare, AWS, or GCP. section 5.1.1
- Test request cancellation and connection cleanup rather than relying only on concurrent-request limits. section 5.1.1
