{"id":140668,"date":"2025-08-14T11:12:07","date_gmt":"2025-08-14T09:12:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak"},"modified":"2025-08-14T11:12:07","modified_gmt":"2025-08-14T09:12:07","slug":"uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak","title":{"rendered":"Vulnerabilno\u015b\u0107 w implementacjach protoko\u0142u HTTP\/2, u\u0142atwiaj\u0105ca przeprowadzanie atak\u00f3w DoS.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Wprowadzono now\u0105 technik\u0119 ataku na implementacje protoko\u0142u HTTP\/2, kt\u00f3ra u\u0142atwia przeprowadzanie atak\u00f3w na podstawie wyczerpywania zasob\u00f3w serwera. Wykryta luka otrzyma\u0142a kodow\u0105 nazw\u0119 MadeYouReset i pozwala na przesy\u0142anie du\u017cej liczby \u017c\u0105da\u0144 do serwera za pomoc\u0105 manipulacji ramkami steruj\u0105cymi HTTP\/2, omijaj\u0105c ustalone ograniczenia. <\/p>\n

Istota problemu polega na tym, \u017ce klient mo\u017ce utworzy\u0107 bardzo du\u017c\u0105 liczb\u0119 r\u00f3wnocze\u015bnie przetwarzanych strumieni, niezale\u017cnie od limitu SETTINGS_MAX_CONCURRENT_STREAMS, resetuj\u0105c ka\u017cdy strumie\u0144 na wczesnym etapie. Tego rodzaju reset powoduje, \u017ce do wys\u0142ania nowego \u017c\u0105dania w ustalonym po\u0142\u0105czeniu HTTP\/2 klient nie musi czeka\u0107 na odpowied\u017a. serwera<\/a> Mo\u017ce od razu skierowa\u0107 du\u017c\u0105, nieprzerwan\u0105 rz\u0119dy \u017c\u0105da\u0144, w ramach mo\u017cliwo\u015bci przepustowo\u015bci kana\u0142u komunikacyjnego. <\/p>\n

Klient przestaje by\u0107 uzale\u017cniony od op\u00f3\u017anie\u0144 mi\u0119dzy wys\u0142aniem \u017c\u0105dania a otrzymaniem odpowiedzi (RTT, round-trip time) i mo\u017ce przeprowadzi\u0107 atak przy minimalnych kosztach operacyjnych, podczas gdy serwer nadal wydaje zasoby na przetwarzanie nadchodz\u0105cych \u017c\u0105da\u0144. Na przyk\u0142ad, serwer musi alokowa\u0107 struktury danych dla nowych strumieni, analizowa\u0107 \u017c\u0105danie, rozpakowa\u0107 nag\u0142\u00f3wek i dopasowa\u0107 URL do zasobu. W przypadku ataku na odwrotne serwery proxy, atak mo\u017ce rozprzestrzeni\u0107 si\u0119 na backendy, na kt\u00f3re proxy zd\u0105\u017cy przekaza\u0107 \u017c\u0105danie przed jego zresetowaniem. <\/p>\n

Wra\u017cliwo\u015b\u0107 przypomina wcze\u015bniej znan\u0105 problematyk\u0119 Rapid Reset (CVE-2023-44487) i jest spowodowana niezgodno\u015bci\u0105 logiki resetowania strumieni, okre\u015blonej w specyfikacji protoko\u0142u HTTP\/2 oraz zaimplementowanej w ko\u0144cowych produktach. W specyfikacji przewidziano mo\u017cliwo\u015b\u0107 resetowania strumienia przez klienta i serwer w dowolnym momencie, jednak w wielu implementacjach HTTP\/2,serwer\u00f3w<\/a> po takim resecie \u017c\u0105danie nadal jest przetwarzane. Kluczow\u0105 r\u00f3\u017cnic\u0105 nowego ataku jest to, \u017ce resetowanie przetwarzania \u017c\u0105dania ma miejsce z inicjatywy serwera, a nie poprzez wys\u0142anie przez klienta ramki z flag\u0105 RST_STREAM. <\/p>\n

Reset initiated by the server occurs when invalid requests are received, but such requests are discarded immediately without starting their full processing and without passing to the backend. In order to achieve a complete processing cycle of the request, the attacker can first send a correct HTTP request, followed by an incorrect sequence of control frames in HTTP\/2. Such activity will result in the server starting to fully process the request, but then due to an error in processing the subsequent frames, it will drop the stream (changing the stream with the correct request to the RST_STREAM state).

\"Vulnerabilno\u015b\u0107<\/center> <\/p>\n

The issue has been confirmed in HTTP servers such as Apache Tomcat, Netty, Eclipse Jetty, Fastly, varnish, lighttpd, and Zephyr RTOS. The problem is also manifested on websites and server services of Mozilla. Apache httpd, Apache Traffic Server, Node.js, LiteSpeed, and HAProxy are not affected by the issue. The vulnerability status in nginx has not been determined.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0443\u043f\u0440\u043e\u0449\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0430\u0442\u0430\u043a \u0434\u043b\u044f \u0432\u044b\u0437\u043e\u0432\u0430 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f MadeYouReset \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u043c\u0438 \u043a\u0430\u0434\u0440\u0430\u043c\u0438 HTTP\/2 \u043d\u0430\u0432\u043e\u0434\u043d\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440 \u0431\u043e\u043b\u044c\u0448\u0438\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e\u043c \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0432 \u043e\u0431\u0445\u043e\u0434 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439. \u0421\u0443\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043a\u043b\u0438\u0435\u043d\u0442 \u043c\u043e\u0436\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043e\u0447\u0435\u043d\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u0447\u0438\u0441\u043b\u043e \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u043e\u0442\u043e\u043a\u043e\u0432, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":140669,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-140668","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Wra\u017cliwo\u015b\u0107 w implementacjach protoko\u0142u HTTP\/2, upraszczaj\u0105ca przeprowadzanie atak\u00f3w DoS | ProHoster","description":"Przedstawiono now\u0105 technik\u0119 ataku na implementacje protoko\u0142u HTTP\/2, upraszczaj\u0105c\u0105 przeprowadzanie atak\u00f3w maj\u0105cych na celu wywo\u0142anie odmowy us\u0142ugi poprzez wyczerpanie zasob\u00f3w serwera.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0443\u043f\u0440\u043e\u0449\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 DoS-\u0430\u0442\u0430\u043a | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0443\u043f\u0440\u043e\u0449\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0430\u0442\u0430\u043a \u0434\u043b\u044f \u0432\u044b\u0437\u043e\u0432\u0430 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-08-14T09:12:07+00:00","article:modified_time":"2025-08-14T09:12:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"140668","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:52:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:15:21","updated":"2026-02-22 15:52:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/140668","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=140668"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/140668\/revisions"}],"predecessor-version":[{"id":162504,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/140668\/revisions\/162504"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media\/140669"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=140668"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=140668"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=140668"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}