{"id":140668,"date":"2025-08-14T11:12:07","date_gmt":"2025-08-14T09:12:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak"},"modified":"2025-08-14T11:12:07","modified_gmt":"2025-08-14T09:12:07","slug":"uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak","title":{"rendered":"Zranite\u013enos\u0165 v implement\u00e1ci\u00e1ch protokolu HTTP\/2, ktor\u00e1 u\u013eah\u010duje vykon\u00e1vanie DoS \u00fatokov.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Bola predstaven\u00e1 nov\u00e1 technika \u00fatoku na implement\u00e1cie protokolu HTTP\/2, ktor\u00e1 zjednodu\u0161uje vykon\u00e1vanie \u00fatokov na v\u00fdpadok slu\u017eieb prostredn\u00edctvom vy\u010derpania prostriedkov servera. Zranite\u013enos\u0165 dostala k\u00f3dov\u00e9 meno MadeYouReset a umo\u017e\u0148uje manipul\u00e1ciou s riadiacimi r\u00e1mcami HTTP\/2 zaplavi\u0165 server ve\u013ek\u00fdm mno\u017estvom po\u017eiadaviek obch\u00e1dzaj\u00facich jeho nastaven\u00e9 obmedzenia. <\/p>\n

Podstatou probl\u00e9mu je, \u017ee klient m\u00f4\u017ee vytvori\u0165 ve\u013emi ve\u013ek\u00e9 mno\u017estvo s\u00fa\u010dasne spracov\u00e1van\u00fdch pr\u00fadov, bez oh\u013eadu na obmedzenie SETTINGS_MAX_CONCURRENT_STREAMS, pri\u010dom ka\u017ed\u00fd pr\u00fad resetuje v po\u010diato\u010dnej f\u00e1ze. Tak\u00fdto reset vedie k tomu, \u017ee na odoslanie novej \u017eiadosti v zriadenom pripojen\u00ed HTTP\/2 klient nepotrebuje \u010daka\u0165 na odpove\u010f od servera<\/a> a m\u00f4\u017ee okam\u017eite nasmerova\u0165 ve\u013ek\u00fd nepretr\u017eit\u00fd pr\u00fad po\u017eiadaviek, ko\u013eko povo\u013euje \u0161\u00edrka p\u00e1sma spojenia. <\/p>\n

Klient prest\u00e1va z\u00e1visie\u0165 od oneskoren\u00ed medzi odoslan\u00edm po\u017eiadavky a prijat\u00edm odpovede (RTT, round-trip time) a m\u00f4\u017ee uskuto\u010dni\u0165 \u00fatok s minim\u00e1lnymi n\u00e1kladmi, zatia\u013e \u010do server na\u010falej spotrebov\u00e1va prostriedky na spracovanie prich\u00e1dzaj\u00facich po\u017eiadaviek. Napr\u00edklad server vykon\u00e1va alok\u00e1ciu \u0161trukt\u00far d\u00e1t pre nov\u00e9 pr\u00fady, anal\u00fdzu po\u017eiadavky, rozbalenie hlavi\u010dky a priradenie URL k zdroju. Pri \u00fatoku na reverzn\u00e9 proxy sa \u00fatok m\u00f4\u017ee roz\u0161\u00edri\u0165 na backendy, na ktor\u00e9 proxy stihne presmerova\u0165 po\u017eiadavku pred jej resetovan\u00edm. <\/p>\n

Zranite\u013enos\u0165 pripom\u00edna predt\u00fdm zn\u00e1my probl\u00e9m Rapid Reset (CVE-2023-44487) a je sp\u00f4soben\u00e1 nes\u00faladom logiky resetovania pr\u00fadov definovanej v \u0161pecifik\u00e1cii protokolu HTTP\/2 a implementovanej vo fin\u00e1lnych produktoch. V \u0161pecifik\u00e1cii je predpokladan\u00e1 mo\u017enos\u0165 resetovania pr\u00fadu z\u00e1kazn\u00edkom a serverom v akomko\u013evek okamihu, ale v mnoh\u00fdch implement\u00e1ci\u00e1ch HTTP\/2serverov<\/a> po takomto resetovan\u00ed po\u017eiadavka pokra\u010duje v spracovan\u00ed. K\u013e\u00fa\u010dov\u00fdm rozdielom nov\u00e9ho \u00fatoku je, \u017ee reset spracov\u00e1vania po\u017eiadavky je vykonan\u00fd zo strany servera, a nie prostredn\u00edctvom odoslania r\u00e1mca s vlajkou RST_STREAM zo strany klienta. <\/p>\n

Server-initiated resets occur when invalid requests are received, but such requests are immediately discarded without initiating full processing or passing them to the backend. To achieve a complete request processing cycle, an attacker may first send a valid HTTP request, followed by an incorrect sequence of HTTP\/2 control frames. Such activity will cause the server to fully process the request, but then due to an error in processing the subsequent frames, it will reset the stream (transitioning the stream with the valid request to RST_STREAM state).

\"Zranite\u013enos\u0165<\/center> <\/p>\n

The issue has been confirmed in HTTP servers like Apache Tomcat, Netty, Eclipse Jetty, Fastly, Varnish, Lighttpd, and Zephyr RTOS. The problem also manifests on Mozilla's websites and server services. Apache httpd, Apache Traffic Server, Node.js, LiteSpeed, and HAProxy are not affected by the issue. The status of vulnerability in nginx is undetermined.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0443\u043f\u0440\u043e\u0449\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0430\u0442\u0430\u043a \u0434\u043b\u044f \u0432\u044b\u0437\u043e\u0432\u0430 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f MadeYouReset \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u043c\u0438 \u043a\u0430\u0434\u0440\u0430\u043c\u0438 HTTP\/2 \u043d\u0430\u0432\u043e\u0434\u043d\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440 \u0431\u043e\u043b\u044c\u0448\u0438\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e\u043c \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0432 \u043e\u0431\u0445\u043e\u0434 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439. \u0421\u0443\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043a\u043b\u0438\u0435\u043d\u0442 \u043c\u043e\u0436\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043e\u0447\u0435\u043d\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u0447\u0438\u0441\u043b\u043e \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u043e\u0442\u043e\u043a\u043e\u0432, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":140669,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-140668","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerability in HTTP\/2 protocol implementations, simplifying the execution of DoS attacks | ProHoster","description":"A new attack technique on implementations of the HTTP\/2 protocol has been introduced, simplifying the execution of denial-of-service attacks through server resource exhaustion.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0443\u043f\u0440\u043e\u0449\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 DoS-\u0430\u0442\u0430\u043a | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0443\u043f\u0440\u043e\u0449\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0430\u0442\u0430\u043a \u0434\u043b\u044f \u0432\u044b\u0437\u043e\u0432\u0430 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-08-14T09:12:07+00:00","article:modified_time":"2025-08-14T09:12:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"140668","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:52:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:15:21","updated":"2026-02-22 15:52:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/140668","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=140668"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/140668\/revisions"}],"predecessor-version":[{"id":162504,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/140668\/revisions\/162504"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/140669"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=140668"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=140668"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=140668"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}