Record-Breaking 73 Tbps DDoS Attack Highlights Critical Internet Security Flaws
In June 2025, a Distributed Denial-of-Service (DDoS) attack measuring an unprecedented 73 million requests per second (RPS) shook the internet, marking a record-breaking event. Detected by cloud providers like Google Cloud, AWS, and Cloudflare, this attack exploited a critical vulnerability in the HTTP/2 protocol, revealing alarming gaps in internet security infrastructure.
What Happened in the 73 Tbps DDoS Attack?
This record-breaking DDoS attack was carried out using a method dubbed “HTTP/2 Rapid Reset.” The attackers exploited a weakness in how HTTP/2 handles stream cancellation requests. By rapidly sending and canceling requests, malicious actors forced web servers to expend significant resources, overwhelming their capacity.
Key Technical Details:
- Vulnerability: HTTP/2 stream cancellation abuse
- Protocol Exploited: HTTP/2
- Attack Volume: Over 73 million requests per second in a record-breaking DDoS incident
- Attack Vector: Botnets and hijacked IPs
- Cloud Providers Affected: Google Cloud, AWS, Cloudflare
Why This Attack Is a Wake-Up Call
- Unprecedented Scale:
Previous high-water marks for DDoS attacks have now been shattered. The 73 Tbps mark sets a dangerous new precedent. - Protocol-Level Exploit:
Instead of using brute force alone, this attack leveraged flaws in a widely adopted protocol (HTTP/2), proving how deep vulnerabilities can bypass conventional defense. - Massive Infrastructure Impact:
Even the largest and most prepared cloud providers had to deploy emergency patches and mitigation measures in real time, showcasing the vulnerability in record-breaking DDoS scenarios.
Response from Major Cloud Providers
Google Cloud
Detected and analyzed the exploit, releasing patches and actively mitigating attacks in collaboration with global partners.
AWS (Amazon Web Services)
Implemented layered security measures and pushed advisories to customers to update server software.
Cloudflare
Disclosed that it had mitigated thousands of similar but smaller-scale attacks using the same method before the peak 73 Tbps hit, demonstrating awareness of potential record-breaking DDoS threats.
What Can Businesses and Developers Do?
1. Update HTTP/2 Libraries and Web Servers
Apply patches released by your server software providers immediately.
2. Implement Rate Limiting and Traffic Analysis
Adopt intelligent traffic filtering, including anomaly detection for unexpected request patterns.
3. Use DDoS Protection Services
Partner with reliable cloud security providers that offer proactive DDoS protection and threat intelligence.
Final Thoughts
The 73 Tbps DDoS attack is not just a number—it’s a signal. Protocol-level flaws, like the one in HTTP/2, can have massive global impacts. Enterprises, developers, and hosting providers must treat protocol security with the same urgency as application-level vulnerabilities to prevent record-breaking DDoS occurrences.
