The HTTP/2 Rapid Reset vulnerability (CVE-2023-44487) received a 7.5 CVSS score — but this rating is analytically misleading and operationally dangerous. A 7.5 suggests moderate severity suitable for routine patching cycles. The EPSS score of 0.99999 tells the truth: near-certain exploitation within 24 hours. The gap between these numbers is not a scoring anomaly; it's a structural failure in how CVSS handles protocol-layer vulnerabilities.
This is not a traditional vulnerability. The rapid reset attack exploits RFC-compliant HTTP/2 behavior — the RST_STREAM frame that lets clients cancel requests — by weaponizing scale against servers that assumed this mechanism would be used reasonably. No amount of secure coding could have prevented it. The flaw was latent in the HTTP/2 specification itself, embedded in the asymmetry between a client's ability to reset streams rapidly and a server's ability to absorb those resets. Caddy developers could have written flawless Rust and still shipped a server vulnerable to collapse under RFC-compliant traffic.
The operational timeline confirms the severity gap. CISA KEV lists active exploitation starting in August 2023 — months before patches reached most production systems. Sophisticated actors understood immediately what the CVSS score obscured: this is a transitive dependency problem. Patching your Caddy instance is necessary but not sufficient. Every upstream CDN, load balancer, and reverse proxy in your request path must also be patched, because attackers will find the slowest link in the chain.
For immediate defense: implement connection-level rate limiting on RST_STREAM frames, monitor stream creation-to-reset intervals for sub-100ms patterns, and audit upstream dependencies for patch status. For HTTP/3, note that QUIC's similar stream cancellation mechanism appears to replicate the underlying vulnerability — the protocol-layer pattern repeats across generations.
The deeper lesson is that CVSS cannot distinguish between 'your code has a flaw' and 'the protocol your code implements has a flaw.' These demand fundamentally different responses — one is a patch, the other is a migration. Until scoring systems account for this, protocol-layer vulnerabilities will continue to be underscored while EPSS screams the truth.