{"id":140668,"date":"2025-08-14T11:12:07","date_gmt":"2025-08-14T09:12:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak"},"modified":"2025-08-14T11:12:07","modified_gmt":"2025-08-14T09:12:07","slug":"uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak","title":{"rendered":"Vulnerabilitet n\u00eb implementimet e protokollit HTTP\/2, q\u00eb leht\u00ebson realizimin e sulmeve DoS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cbsht\u00eb paraqitur nj\u00eb teknik\u00eb e re sulmi ndaj implementimeve t\u00eb protokollit HTTP\/2, q\u00eb thjeshton realizimin e sulmeve p\u00ebr t\u00eb shkaktuar mosfunksionim p\u00ebrmes shterimit t\u00eb burimeve t\u00eb serverit. Vulnerabiliteti mori emrin kodor MadeYouReset dhe lejon, p\u00ebrmes manipulimeve t\u00eb kadrove kontrolluese t\u00eb HTTP\/2, t\u00eb mbushen server\u00ebt me nj\u00eb num\u00ebr t\u00eb madh k\u00ebrkesash duke anashkaluar kufizimet e vendosura. <\/p>\n

Thelbi i problemit \u00ebsht\u00eb se klienti mund t\u00eb krijoj\u00eb nj\u00eb num\u00ebr shum\u00eb t\u00eb madh rrjedhash q\u00eb p\u00ebrpunohen paralelisht, pavar\u00ebsisht kufirit SETTINGS_MAX_CONCURRENT_STREAMS, duke e rikthyer \u00e7do rrjedh n\u00eb faz\u00ebn fillestare. Nj\u00eb rikthim i till\u00eb \u00e7on n\u00eb at\u00eb q\u00eb p\u00ebr t\u00eb d\u00ebrguar nj\u00eb k\u00ebrkes\u00eb t\u00eb re n\u00eb lidhjen e vendosur HTTP\/2, klienti nuk nevojitet t\u00eb pres\u00eb p\u00ebrgjigjen nga \u0441\u0435\u0440\u0432\u0435\u0440\u0430<\/a> dhe mund t\u00eb d\u00ebrgoj\u00eb menj\u00ebher\u00eb nj\u00eb fluks t\u00eb madh k\u00ebrkesash t\u00eb pand\u00ebrprera, sa m\u00eb shum\u00eb lejon kapaciteti i kanalit t\u00eb komunikimit. <\/p>\n

Klienti nuk vares nga vonesat mes d\u00ebrgimit t\u00eb k\u00ebrkes\u00ebs dhe marrjes s\u00eb p\u00ebrgjigjes (RTT, koha e kthimit) dhe mund t\u00eb realizoj\u00eb nj\u00eb sulm me shpenzime minimale, nd\u00ebrsa serveri vazhdon t\u00eb shpenzoj\u00eb burime p\u00ebr t\u00eb p\u00ebrpunuar k\u00ebrkesat e ardhura. P\u00ebr shembull, serveri kryen alokimin e strukturave t\u00eb dh\u00ebnash p\u00ebr rrjedhat e reja, analizimin e k\u00ebrkes\u00ebs, shp\u00ebrb\u00ebrjen e kok\u00ebs dhe p\u00ebrputhjen e URL-s\u00eb me burimin. N\u00eb sulmet ndaj proxy-ve t\u00eb pasme, sulmi mund t\u00eb p\u00ebrhapet n\u00eb backend-in ku proxy-u arrin t\u00eb redirektoj\u00eb k\u00ebrkes\u00ebn para se t\u00eb rikthehet. <\/p>\n

Vulnerabiliteti i ngjan problemit t\u00eb njohur m\u00eb par\u00eb Rapid Reset (CVE-2023-44487) dhe shkaktohet nga mosp\u00ebrputhja e logjik\u00ebs s\u00eb rikthimeve t\u00eb rrjedhave, t\u00eb p\u00ebrcaktuar n\u00eb specifikimin e protokollit HTTP\/2 dhe t\u00eb realizuar n\u00eb produktet p\u00ebrfundimtare. N\u00eb specifikim parashikohet mund\u00ebsia e rikthimit t\u00eb rrjedh\u00ebs nga klienti dhe serveri n\u00eb \u00e7do moment, por n\u00eb shum\u00eb implementime HTTP\/2-server\u00ebsh<\/a> pas nj\u00eb rikthimi t\u00eb till\u00eb k\u00ebrkesa vazhdon t\u00eb p\u00ebrpunoj\u00eb. Dallimi ky\u00e7 i sulmit t\u00eb ri \u00ebsht\u00eb se rikthimi i p\u00ebrpunimit t\u00eb k\u00ebrkes\u00ebs kryhet n\u00eb iniciativ\u00ebn e serverit, dhe jo p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb kadrove nga klienti me flamurin RST_STREAM. <\/p>\n

Riv\u00eb k\u00ebndv\u00ebshtrimi i serverit ndodh kur jan\u00eb t\u00eb pranuara k\u00ebrkesa t\u00eb papregatuara, por k\u00ebrkesat e tilla hidhen menj\u00ebher\u00eb pa filluar p\u00ebrpunimi i tyre t\u00eb plot\u00eb dhe pa u d\u00ebrguar n\u00eb backend. P\u00ebr t\u00eb arritur nj\u00eb cik\u00ebl t\u00eb plot\u00eb t\u00eb p\u00ebrpunimit t\u00eb k\u00ebrkes\u00ebs, sulmuesi fillimisht mund t\u00eb d\u00ebrgoj\u00eb nj\u00eb k\u00ebrkes\u00eb HTTP t\u00eb sakt\u00eb, por m\u00eb pas t\u00eb d\u00ebrgoj\u00eb nj\u00eb sekuenc\u00eb t\u00eb pap\u00ebrshtatshme t\u00eb kuadrove t\u00eb kontrollit HTTP\/2. Aktiviteti i till\u00eb do t\u00eb \u00e7oj\u00eb n\u00eb p\u00ebrpunimin e plot\u00eb t\u00eb k\u00ebrkes\u00ebs nga serveri, por m\u00eb pas p\u00ebr shkak t\u00eb nj\u00eb gabimi gjat\u00eb p\u00ebrpunimit t\u00eb kuadrove q\u00eb vijn\u00eb pas do t\u00eb kthej\u00eb rrjedh\u00ebn n\u00eb gjendjen RST_STREAM.

\"Vulnerabilitet<\/center> <\/p>\n

Problemi \u00ebsht\u00eb konfirmuar n\u00eb server\u00ebt HTTP si Apache Tomcat, Netty, Eclipse Jetty, Fastly, varnish, lighttpd, Zephyr RTOS. Problemi shfaqet gjithashtu n\u00eb faqet dhe sh\u00ebrbimet serverike t\u00eb Mozilla. Apache httpd, Apache Traffic Server, Node.js, LiteSpeed dhe HAProxy nuk preken nga problemi. Statusi i pranish\u00ebm i dob\u00ebsi n\u00eb nginx nuk \u00ebsht\u00eb i p\u00ebrcaktuar.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0443\u043f\u0440\u043e\u0449\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0430\u0442\u0430\u043a \u0434\u043b\u044f \u0432\u044b\u0437\u043e\u0432\u0430 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f MadeYouReset \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u043c\u0438 \u043a\u0430\u0434\u0440\u0430\u043c\u0438 HTTP\/2 \u043d\u0430\u0432\u043e\u0434\u043d\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440 \u0431\u043e\u043b\u044c\u0448\u0438\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e\u043c \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0432 \u043e\u0431\u0445\u043e\u0434 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439. \u0421\u0443\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043a\u043b\u0438\u0435\u043d\u0442 \u043c\u043e\u0436\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043e\u0447\u0435\u043d\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u0447\u0438\u0441\u043b\u043e \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u043e\u0442\u043e\u043a\u043e\u0432, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":140669,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-140668","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsi n\u00eb implementimet e protokollit HTTP\/2, e cila thjeshton zhvillimin e sulmeve DoS | ProHoster","description":"\u00cbsht\u00eb prezantuar nj\u00eb teknik\u00eb e re sulmi ndaj implementimeve t\u00eb protokollit HTTP\/2, e cila thjeshton zhvillimin e sulmeve p\u00ebr t\u00eb shkaktuar refuzim sh\u00ebrbimi p\u00ebrmes shterimit t\u00eb burimeve t\u00eb serverit.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0443\u043f\u0440\u043e\u0449\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 DoS-\u0430\u0442\u0430\u043a | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0443\u043f\u0440\u043e\u0449\u0430\u044e\u0449\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0430\u0442\u0430\u043a \u0434\u043b\u044f \u0432\u044b\u0437\u043e\u0432\u0430 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-realizacziyah-protokola-http-2-uproshhayushhaya-provedenie-dos-atak","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-08-14T09:12:07+00:00","article:modified_time":"2025-08-14T09:12:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"140668","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:52:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:15:21","updated":"2026-02-22 15:52:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/140668","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=140668"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/140668\/revisions"}],"predecessor-version":[{"id":162504,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/140668\/revisions\/162504"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/140669"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=140668"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=140668"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=140668"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}