HTTP/2 Rapid Reset Attack Impacting NGINX Products - Does this affect 3CX?

[Michael Menor]

Opened a support case on Wednesday, but still haven't received a response. Anyone else know about this?

Researchers and vendors have disclosed a denial-of-service (DoS) vulnerability in HTTP/2 protocol. The vulnerability (CVE-2023-44487), known as Rapid Reset, has been exploited in the wild in August 2023 through October 2023.

CISA recommends organizations that provide HTTP/2 services apply patches when available and consider configuration changes and other mitigations discussed in the references below. For more information on Rapid Reset, see:

• NGINX: HTTP/2 Rapid Reset Attack Impacting NGINX Products

 

[WKN_Benedict]

Quoting the article by nginx:

By relying on the default keepalive limit, NGINX prevents this type of attack.

A standard installation of 3CX on linux does not change "keepalive_requests" or "http2_max_concurrent_streams".

An official response would still be good of course.