From a5fde263447b3ff4d7e18cfb3820c9eaa9efbfff Mon Sep 17 00:00:00 2001 From: PJ Fanning Date: Wed, 29 Jul 2026 22:19:17 +0100 Subject: [PATCH 1/2] enable by default - pekko.http.server.http2.frame-type-throttle.frame-types = ["reset"] --- http-core/src/main/resources/reference.conf | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/http-core/src/main/resources/reference.conf b/http-core/src/main/resources/reference.conf index b47d6c48e..0d739956b 100644 --- a/http-core/src/main/resources/reference.conf +++ b/http-core/src/main/resources/reference.conf @@ -316,10 +316,11 @@ pekko.http { frame-type-throttle { # Configure the throttle for non-data frame types (https://github.com/apache/pekko-http/issues/332). - # The supported frame-types for throttlng are: + # The supported frame-types for throttling are: # reset, headers, continuation, go-away, priority, ping, push-promise, window-update - # If you are concerned about CVE-2023-44487, you could set: pekko.http.server.http2.frame-type-throttle.frame-types = ["reset"] - frame-types = [] + # By default, RST_STREAM frames are throttled to mitigate HTTP/2 Rapid Reset attacks (CVE-2023-44487). + # Set to [] to disable throttling. + frame-types = ["reset"] cost = 100 burst = 100 # interval must be a positive duration From 7b858657e13a7e606040cd50fc70ba34d84d0b61 Mon Sep 17 00:00:00 2001 From: PJ Fanning Date: Wed, 29 Jul 2026 22:43:05 +0100 Subject: [PATCH 2/2] Update Http2ServerDisableFrameTypeThrottleSpec.scala --- .../engine/http2/Http2ServerDisableFrameTypeThrottleSpec.scala | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/http2-tests/src/test/scala/org/apache/pekko/http/impl/engine/http2/Http2ServerDisableFrameTypeThrottleSpec.scala b/http2-tests/src/test/scala/org/apache/pekko/http/impl/engine/http2/Http2ServerDisableFrameTypeThrottleSpec.scala index ee399de80..7b02552c9 100644 --- a/http2-tests/src/test/scala/org/apache/pekko/http/impl/engine/http2/Http2ServerDisableFrameTypeThrottleSpec.scala +++ b/http2-tests/src/test/scala/org/apache/pekko/http/impl/engine/http2/Http2ServerDisableFrameTypeThrottleSpec.scala @@ -21,10 +21,11 @@ import pekko.http.impl.engine.http2.framing.FrameRenderer import pekko.util.ByteStringBuilder /** - * This tests the http2 server throttle support for rapid resets is disabled by default. + * This tests the http2 server throttle support for rapid resets when explicitly disabled. */ class Http2ServerDisableFrameTypeThrottleSpec extends Http2SpecWithMaterializer(""" pekko.http.server.http2.log-frames = on + pekko.http.server.http2.frame-type-throttle.frame-types = [] """) { override def failOnSevereMessages: Boolean = true