NRDAX-T0112 - HTTP/2 Rapid Reset Stream Exhaustion

mechanism

CVE-2023-26964 (RUSTSEC-2023-0034): the Rust h2 crate < 0.3.17 does not release stream memory immediately on RST_STREAM and - pre-0.3.17 - has NO bound on streams in the pending-accept-but-remotely-reset state. An unauthenticated attacker cycles HEADERS(open stream)->RST_STREAM(cancel) faster than the application accepts requests off the queue; the queue grows unbounded -> excessive memory + CPU -> OOM (HTTP/2 Rapid Reset, CVE-2023-44487 class). Substrate/polkadot consumed h2 0.3.16 (indirect dep via hyper) on the node JSON-RPC HTTP server (jsonrpsee) and the prometheus monitoring endpoint until paritytech/substrate#13915 bumped it to 0.3.17. The fix (hyperium/h2#668) ADDS max_pending_accept_reset_streams and, on hitting the limit, sends GOAWAY(ENHANCE_YOUR_CALM) and errors the connection - behaviour the vulnerable versions lack, so a pre-0.3.17 server never issues GOAWAY. Network-triggered, availability-only (CVSS 7.5, AV:N/A:H). Faithful known-class replication of the HEADERS+RST_STREAM rapid-reset wire signature; the OOM impact is the CVE's, not reproduced against a live node. source_class=public-cve-replication. Distinct target from walrus_http2_rapid_reset (which is a walrus config disabling an EXISTING h2 limit; here the crate itself has no limit).

research

In-depth write-ups of this attack on nullrabbit.ai.

instances (2)

references

related (Memory amplification)

cite

https://nrdax.com/techniques/NRDAX-T0112

@misc{nrdax_NRDAX_T0112,
  title = {HTTP/2 Rapid Reset Stream Exhaustion (NRDAX-T0112)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0112},
}

{
  "id": "nrdax-NRDAX-T0112",
  "type": "dataset",
  "title": "HTTP/2 Rapid Reset Stream Exhaustion (NRDAX-T0112)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0112",
  "publisher": "NRDAX Registry"
}

[![NRDAX-T0112 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0112.svg)](https://nrdax.com/techniques/NRDAX-T0112-http-2-rapid-reset-stream-exhaustion)