Multiple HTTP/2 implementations are vulnerable to a denial-of-service attack where unauthenticated attackers can exhaust server resources via malformed stream reset requests.

The vulnerability exists due to improper resource management when handling client-triggered HTTP/2 stream resets. An unauthenticated attacker can exploit this by opening numerous streams and forcing server-side resets, causing the server to maintain unbounded concurrent streams that consume excessive CPU and memory.

Successful exploitation of this vulnerability leads to service degradation or complete system unavailability. Given the CVSS score of 7.5, this represents a high-severity risk to business continuity, as critical web services can be rendered unreachable by unauthenticated remote attackers without requiring any prior system access.

Immediate Action: Identify if your infrastructure utilizes affected software such as Varnish Cache or H2O and apply the vendor-supplied security patches immediately. Review the specific vendor advisories listed in the reference section for your platform.

Proactive Monitoring: Monitor server resource utilization, specifically tracking CPU spikes and memory consumption associated with HTTP/2 connections. Review web server access logs for anomalous patterns of rapid stream reset requests or malformed frame errors.

Compensating Controls: Deploy or tune a Web Application Firewall (WAF) to detect and block malformed HTTP/2 frames or excessive stream reset requests. Rate limiting on the number of concurrent streams per connection can also help mitigate the impact of this resource exhaustion.

Public Exploit Available: Yes, multiple public proof-of-concept repositories exist on GitHub.

The presence of public proof-of-concept code necessitates swift action to secure internet-facing HTTP/2 infrastructure. Administrators should prioritize patching affected web servers and proxies to prevent potential denial-of-service attacks that could disrupt business operations.