MITRE: CVE-2023-44487 HTTP/2 Rapid Reset Attack

The following workarounds might be helpful in your situation. In all cases, Microsoft strongly recommends that you install the updates for this vulnerability as soon as possible even if you plan to leave either of these workarounds in place:

Disable the HTTP/2 protocol on your web server by using the Registry Editor

Note Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.

1. Click Start, click Run, type Regedit in the Open box, and then click OK.
2. Locate and then click the following registry subkey: HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters
3. Set DWORD type values EnableHttp2Tls and EnableHttp2Cleartext to one of the following:
   • Set to 0 to disable HTTP/2
   • Set to 1 to enable HTTP/2
4. Exit Registry Editor.
5. Restart the computer.

Include a protocols setting for each Kestrel endpoint to limit your application to HTTP1.1

For .NET and Kestrel, servers without HTTP/2 enabled are not affected. To limit your application to HTTP1.1 via config, edit your appsettings.json to include a protocols setting for each endpoint:

"Kestrel": {
   "Endpoints": { 
     "http": { 
       // your existing config 
       "Protocols": "Http1" 
     }, 
     "https": { 
        // your existing config 
       "Protocols": "Http1" 
     } 
   } 
 } 
	
	```