Collected research

HTTP/2 Rapid Reset: deconstructing the record-breaking attack

Lucas Pardue and Julien Desgats · Cloudflare · 10 October 2023

Explains how clients rapidly create and cancel HTTP/2 streams, keeping concurrent streams low while inducing server request work. Production observations and packet traces distinguish the cancellation pattern from ordinary HTTP/2 traffic and show why stream concurrency limits alone are insufficient. Mitigations bound cancellation and request-processing cost.

Record

Researcher

Lucas Pardue and Julien Desgats

Published by

Cloudflare

Date

10 October 2023

Topic

HTTP

In the archive

• Collected in the 2023 research round

Tags

• http2
• dos
• case-study

This page is the archive's own catalogue record. The research is the work of Lucas Pardue and Julien Desgats, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 29 September 2026.