{"id":140668,"date":"2025-08-14T11:12:07","date_gmt":"2025-08-14T09:12:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak"},"modified":"2025-08-14T11:12:07","modified_gmt":"2025-08-14T09:12:07","slug":"uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak","title":{"rendered":"Zranitelnost ve implementac\u00edch protokolu HTTP\/2, kter\u00e1 usnad\u0148uje prov\u00e1d\u011bn\u00ed DoS \u00fatok\u016f","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Byla p\u0159edstavena nov\u00e1 technika \u00fatoku na implementace protokolu HTTP\/2, kter\u00e1 zjednodu\u0161uje prov\u00e1d\u011bn\u00ed \u00fatok\u016f na zablokov\u00e1n\u00ed slu\u017eeb pomoc\u00ed vy\u010derp\u00e1n\u00ed serverov\u00fdch zdroj\u016f. Zranitelnost dostala k\u00f3dov\u00e9 jm\u00e9no MadeYouReset a umo\u017e\u0148uje prost\u0159ednictv\u00edm manipulace s \u0159\u00edd\u00edc\u00edmi r\u00e1mci HTTP\/2 zahlcovat server velk\u00fdm mno\u017estv\u00edm po\u017eadavk\u016f, obch\u00e1zej\u00edc\u00ed stanoven\u00e1 omezen\u00ed. <\/p>\n

Podstatou probl\u00e9mu je, \u017ee klient m\u016f\u017ee vytvo\u0159it velmi velk\u00e9 mno\u017estv\u00ed sou\u010dasn\u011b zpracov\u00e1van\u00fdch tok\u016f, bez ohledu na limit SETTINGS_MAX_CONCURRENT_STREAMS, a resetovat ka\u017ed\u00fd tok v po\u010d\u00e1te\u010dn\u00ed f\u00e1zi. Takov\u00fd reset znamen\u00e1, \u017ee k odesl\u00e1n\u00ed nov\u00e9ho po\u017eadavku v r\u00e1mci stanoven\u00e9ho spojen\u00ed HTTP\/2 nemus\u00ed klient \u010dekat na odpov\u011b\u010f od serveru<\/a> a m\u016f\u017ee okam\u017eit\u011b sm\u011brovat velk\u00fd nep\u0159etr\u017eit\u00fd tok po\u017eadavk\u016f, jak jen to umo\u017e\u0148uje \u0161\u00ed\u0159ka p\u00e1sma. <\/p>\n

Klient p\u0159est\u00e1v\u00e1 b\u00fdt z\u00e1visl\u00fd na zpo\u017ed\u011bn\u00edch mezi odes\u00edl\u00e1n\u00edm po\u017eadavku a z\u00edsk\u00e1v\u00e1n\u00edm odpov\u011bdi (RTT, round-trip time) a m\u016f\u017ee prov\u00e9st \u00fatok s minim\u00e1ln\u00edmi n\u00e1klady, zat\u00edmco server st\u00e1le vy\u010derp\u00e1v\u00e1 zdroje na zpracov\u00e1n\u00ed p\u0159\u00edchoz\u00edch po\u017eadavk\u016f. Nap\u0159\u00edklad server prov\u00e1d\u00ed alokaci datov\u00fdch struktur pro nov\u00e9 toky, anal\u00fdzu po\u017eadavku, dekompresi hlavi\u010dky a p\u0159i\u0159azen\u00ed URL ke zdroji. P\u0159i \u00fatoku na reverzn\u00ed proxy m\u016f\u017ee b\u00fdt \u00fatok roz\u0161\u00ed\u0159en na backendy, na kter\u00e9 proxy stihne p\u0159esm\u011brovat po\u017eadavek p\u0159ed jeho resetov\u00e1n\u00edm. <\/p>\n

Zranitelnost p\u0159ipom\u00edn\u00e1 d\u0159\u00edve zn\u00e1m\u00fd probl\u00e9m Rapid Reset (CVE-2023-44487) a je zp\u016fsobena rozporami v logice resetov\u00e1n\u00ed tok\u016f definovan\u00e9 ve specifikaci protokolu HTTP\/2 a realizovan\u00e9 v koncov\u00fdch produktech. Ve specifikaci je stanoveno, \u017ee klient a server mohou resetovat tok kdykoli, ale v mnoha implementac\u00edch HTTP\/2servery<\/a> po takov\u00e9m resetu po\u017eadavek pokra\u010duje ve zpracov\u00e1n\u00ed. Kl\u00ed\u010dov\u00fdm rozd\u00edlem nov\u00e9ho \u00fatoku je to, \u017ee resetov\u00e1n\u00ed zpracov\u00e1n\u00ed po\u017eadavku prob\u00edh\u00e1 na iniciativu serveru, nikoli prost\u0159ednictv\u00edm odesl\u00e1n\u00ed r\u00e1mce s flagem RST_STREAM ze strany klienta. <\/p>\n

Server-initiated resets occur when incorrect requests are received, but such requests are immediately discarded without starting full processing or passing them to the backend. To achieve a complete processing cycle, an attacker can initially send a valid HTTP request and then follow it with an incorrect sequence of control frames in HTTP\/2. Such activity will lead to the server starting to process the request fully, but then due to an error in processing the subsequent frames, it will reset the stream (changing the stream with the valid request to RST_STREAM state).

\"Zranitelnost<\/center> <\/p>\n

The issue has been confirmed in HTTP servers such as Apache Tomcat, Netty, Eclipse Jetty, Fastly, Varnish, Lighttpd, and Zephyr RTOS. The problem is also observed on Mozilla websites and server services. Apache httpd, Apache Traffic Server, Node.js, LiteSpeed, and HAProxy are not affected by the issue. The status of the vulnerability in Nginx is undetermined.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0443\u043f\u0440\u043e\u0449\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0430\u0442\u0430\u043a \u0434\u043b\u044f \u0432\u044b\u0437\u043e\u0432\u0430 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f MadeYouReset \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u043c\u0438 \u043a\u0430\u0434\u0440\u0430\u043c\u0438 HTTP\/2 \u043d\u0430\u0432\u043e\u0434\u043d\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440 \u0431\u043e\u043b\u044c\u0448\u0438\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e\u043c \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0432 \u043e\u0431\u0445\u043e\u0434 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439. \u0421\u0443\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043a\u043b\u0438\u0435\u043d\u0442 \u043c\u043e\u0436\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043e\u0447\u0435\u043d\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u0447\u0438\u0441\u043b\u043e \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u043e\u0442\u043e\u043a\u043e\u0432, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":140669,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-140668","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerability in HTTP\/2 protocol implementations that facilitates DoS attacks | ProHoster","description":"A new attack technique has been introduced against implementations of the HTTP\/2 protocol that simplifies the execution of denial-of-service attacks through server resource exhaustion.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0443\u043f\u0440\u043e\u0449\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 DoS-\u0430\u0442\u0430\u043a | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0443\u043f\u0440\u043e\u0449\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0430\u0442\u0430\u043a \u0434\u043b\u044f \u0432\u044b\u0437\u043e\u0432\u0430 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-08-14T09:12:07+00:00","article:modified_time":"2025-08-14T09:12:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"140668","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:52:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:15:21","updated":"2026-02-22 15:52:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/140668","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=140668"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/140668\/revisions"}],"predecessor-version":[{"id":162504,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/140668\/revisions\/162504"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/140669"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=140668"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=140668"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=140668"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}