NRDAX-T0396 - HTTP/2 Multiplexing Rate-Limit Bypass

mechanism

The edge's rate limiter counts HTTP/2 cleartext (h2c) connections at layer 4 (per-IP connection count via limit_conn), while the backend (geth :8545) transparently terminates h2c and honors all multiplexed streams within it as independent requests. An attacker who prior-knowledge-upgrades a single TCP connection to h2c opens many concurrent streams (measured 20/20) inside that one connection, each carrying a full RPC call (e.g. eth_getLogs), so the edge sees '1 connection' while the backend processes N requests, yielding request/data-volume amplification (~43.9MB) with the per-IP connection cap never triggering. The defect class is a mismatch between the connection-granularity enforcement point and the stream-granularity request semantics of the multiplexed protocol; the fix-class is enforcing rate/connection limits at the stream (request) level for any multiplexed transport, or disabling/gating h2c cleartext upgrade at the edge so multiplexing cannot cross the limiter boundary.

research

In-depth write-ups of this attack on nullrabbit.ai.

instances (1)

cite

https://nrdax.com/techniques/NRDAX-T0396

@misc{nrdax_NRDAX_T0396,
  title = {HTTP/2 Multiplexing Rate-Limit Bypass (NRDAX-T0396)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0396},
}

{
  "id": "nrdax-NRDAX-T0396",
  "type": "dataset",
  "title": "HTTP/2 Multiplexing Rate-Limit Bypass (NRDAX-T0396)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0396",
  "publisher": "NRDAX Registry"
}

[![NRDAX-T0396 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0396.svg)](https://nrdax.com/techniques/NRDAX-T0396-http-2-multiplexing-rate-limit-bypass)