CVE-2023-44487: HTTP/2 "Rapid Reset" Vulnerability

[sydlexius 245]

FYI, there's a flaw in the specification for HTTP/2 that is actively being exploited (specifically, DoS attacks).  MS has released updates that mitigates implementations such as .NET (Kestrel), though note that I believe the current mitigation disables HTTP/2.  The long-term fix will be some sort of rate-limiter:

 

https://www.cve.org/CVERecord?id=CVE-2023-44487

Details of the fix and the two new AppContext properties can be found here:

https://github.com/dotnet/announcements/issues/277

Edited October 11, 2023 by sydlexius
(fixed mistake, added details about new options)

[sydlexius 245]

For those of you using Nginx for reverse proxying, it had been implemented in such a way to prevent this sort of attack.

[rbjtech 4337]

Can you add a 'security' tag onto the topic pls - I'm not sure how emby are tagging security related requests/posts, but I've seen the security tag being used before ...