ddos-sim.com All simulations Configure a test

Layer 7 · Application · http2_rapid_reset

HTTP/2 Rapid Reset test (CVE‑2023‑44487)

The http2_rapid_reset simulation opens and instantly cancels HTTP/2 streams — the CVE-2023-44487 pattern — against real HTTP/2 on a domain you own. It is the direct way to confirm whether your servers and proxies are patched against the 2023 record-breaking technique.

Layer L7 Protocol HTTP/2 Command http2_rapid_reset Access Prepaid · paid tier

What HTTP/2 Rapid Reset does

Disclosed in October 2023 as CVE-2023-44487, HTTP/2 Rapid Reset opens a stream and immediately sends RST_STREAM to cancel it, then repeats — endlessly. Each request is cheap for the client but still costs the server the work of setting up and tearing down a stream, and because the streams are cancelled they sidestep the connection's concurrency limit. It drove some of the largest floods ever recorded.

How ddos-sim.com simulates it safely

ddos-sim.com speaks genuine HTTP/2 to a single verified domain pinned to a public address, opening and resetting streams within the rate and concurrency limits for that domain. It reproduces the request-accounting pressure of the real technique so you can verify your patch level and tuning — no spoofing, one verified target.

Authorized targets only

Every run is bound to one verified domain you have proven you own. Ownership is checked over DNS or HTTPS before anything is scheduled, and running traffic against systems you do not own or are not clearly authorized to test may be unlawful. See the Acceptable Use Policy.

What the test exercises

  • Whether your HTTP/2 stack is patched for CVE-2023-44487
  • Per-connection stream accounting and reset handling
  • Proxy, load-balancer, and origin behavior under rapid stream churn
  • Mitigations such as capping resets per connection
  • CPU and memory cost of stream setup/teardown

How to run a http/2 rapid reset test

  1. Verify your domain. Prove ownership over DNS or HTTPS — it is self-service and takes minutes.
  2. Add the http2_rapid_reset command to a timeline in the portal and set the target path or port, rate, and duration.
  3. Set health thresholds. Choose the error-rate, latency, or status-code limits at which the test should abort itself.
  4. Run and watch. Bounded workers are provisioned minutes before start and torn down the moment the last task ends, while metrics stream live.
  5. Read the results. Review the recorded latency, status codes, and worker timeline to find where your service starts to bend.

Configure a http/2 rapid reset test in the portal →

Availability & limits

HTTP/2 Rapid Reset is a paid technique funded by prepaid credits and is excluded from the free allowance. Configure it after domain verification.

Frequently asked questions

What is CVE-2023-44487?

It is the HTTP/2 Rapid Reset vulnerability disclosed in October 2023, in which rapidly opening and cancelling HTTP/2 streams lets an attacker generate huge request volume that bypasses the usual concurrency limit. This test reproduces that pattern against your own server.

How do I know if I am protected?

A patched, well-tuned HTTP/2 stack caps or penalizes excessive stream resets per connection. Running the test against your verified domain shows whether request accounting and mitigations hold up under rapid reset churn.

Rehearse the http/2 rapid reset against infrastructure you own — bounded, monitored, and stopped the instant you have your answer.

Configure a test
← All DDoS simulations