Security52 mOctober 30, 2026, 01:30

Twisted Web hit by HTTP/2 Rapid Reset DoS flaw rated 7.5

Twisted Web up to and including 26.4.0 is vulnerable to an unauthenticated remote denial-of-service via the HTTP/2 Rapid Reset technique, a variant of CVE-2023-44487. Attackers send HEADERS and RST_STREAM frames in one TCP segment to bypass concurrent stream limits and saturate CPU. The fix ships in Twisted 26.10.0rc1 with token-bucket rate limiting on stream resets.

DEV Community

Open source

CVSS 7.5: unauthenticated remote DoS via HTTP/2 Rapid Reset
Affects Twisted Web <= 26.4.0; patched in 26.10.0rc1
Token bucket allows 1000 resets burst and 33 per second, then GOAWAY
Proof-of-concept exists; bypasses MAX_CONCURRENT_STREAMS limit

#Twisted

Kimi apologizes for K3.1 Pro rate limits, resets 25% of members' monthly quota

Software

GitLab to impose rate limits on API, web and Git requests starting October

Security

Istio patches AuthorizationPolicy bypass via HTTP/2 method case

Security

Twisted Web hit by HTTP/2 Rapid Reset DoS flaw rated 7.5

Kimi apologizes for K3.1 Pro rate limits, resets 25% of members' monthly quota

GitLab to impose rate limits on API, web and Git requests starting October

Istio patches AuthorizationPolicy bypass via HTTP/2 method case

Anthropic Warns AI Will Bring Rapid-Fire Software Vulnerabilities