Http2 · CuraSec

tag: Http2 · 2 items

Engineer — Act: A public PoC demonstrating client-side code execution exists; curl is present in virtually every container base image, CI/CD runner, and server. Patch to curl 8.23.0 now — check container base images, pipeline runners, and any service that uploads via HTTP/2.
SOC/IR — Learn: No IOCs, no active exploitation reported, and the attack surface (malicious server exploiting an uploading client) offers limited detection opportunity; understanding the attack vector is useful for triage context if crashes or anomalous curl behavior surface later.
Leader — Skip

Engineer — Learn: The HTTP/2 traffic-mimicry technique is worth understanding when reviewing WAF and CDN rate-limiting rules, but no enrichment signals (no KEV, no PoC, no active targeting) justify an immediate configuration change.
SOC/IR — Plan: The botnet’s ability to blend DDoS volume into legitimate-looking HTTP/2 sessions is a detection gap worth scoping — review whether your traffic-analysis and DDoS-detection rules distinguish request-rate anomalies at the HTTP/2 stream level rather than relying on IP reputation alone.
Leader — Learn: Awareness item for the evolving DDoS evasion landscape; relevant background for the next DDoS-mitigation vendor review or business-continuity risk discussion, but no board-level action is warranted now.