Comment by anshargal | Hacker News Reader

Top New Best Ask Show Jobs

Comment by anshargal | Hacker News Reader

So is nginx with http2 enabled vulnerable too? Caddy? I should I not worry about this, because a small (by Cloudflare scale) botnet may DDoS a single server completely anyway?

Go is patching it soon: https://github.com/caddyserver/caddy/issues/5877#issuecommen...

(Caddy just uses Go's HTTP/2 implementation.)

Go patches are out. (1.21.3, 1.20.10)

nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacti...

caddy: https://github.com/caddyserver/caddy/issues/5877

nginx: https://mailman.nginx.org/pipermail/nginx-devel/2023-October...

Reply on news.ycombinator.com