diff --git a/Network/HTTP2/TLS/Client.hs b/Network/HTTP2/TLS/Client.hs
--- a/Network/HTTP2/TLS/Client.hs
+++ b/Network/HTTP2/TLS/Client.hs
@@ -39,6 +39,12 @@
     settingsOpenClientSocket,
     settingsUseEarlyData,
     settingsOnServerFinished,
+
+    -- ** Rate limits
+    settingsPingRateLimit,
+    settingsEmptyFrameRateLimit,
+    settingsSettingsRateLimit,
+    settingsRstRateLimit,
 ) where
 
 import Data.ByteString (ByteString)
@@ -189,6 +195,10 @@
             (H2Client.settings $ H2Client.defaultClientConfig)
                 { H2Client.initialWindowSize = settingsStreamWindowSize
                 , H2Client.maxConcurrentStreams = Just settingsConcurrentStreams
+                , H2Client.pingRateLimit = settingsPingRateLimit
+                , H2Client.emptyFrameRateLimit = settingsEmptyFrameRateLimit
+                , H2Client.settingsRateLimit = settingsSettingsRateLimit
+                , H2Client.rstRateLimit = settingsRstRateLimit
                 }
         }
 
diff --git a/Network/HTTP2/TLS/Client/Settings.hs b/Network/HTTP2/TLS/Client/Settings.hs
--- a/Network/HTTP2/TLS/Client/Settings.hs
+++ b/Network/HTTP2/TLS/Client/Settings.hs
@@ -92,6 +92,30 @@
     --
     -- Default: 'openClientSocket'
     , settingsOnServerFinished :: Information -> IO ()
+
+    , settingsPingRateLimit :: Int
+    -- ^ Maximum number of pings allowed per second (CVE-2019-9512)
+    --
+    -- >>> settingsPingRateLimit defaultSettings
+    -- 10
+
+    , settingsEmptyFrameRateLimit :: Int
+    -- ^ Maximum number of empty data frames allowed per second (CVE-2019-9518)
+    --
+    -- >>> settingsEmptyFrameRateLimit defaultSettings
+    -- 4
+
+    , settingsSettingsRateLimit :: Int
+    -- ^ Maximum number of settings frames allowed per second (CVE-2019-9515)
+    --
+    -- >>> settingsSettingsRateLimit defaultSettings
+    -- 4
+
+    , settingsRstRateLimit :: Int
+    -- ^ Maximum number of reset frames allowed per second (CVE-2023-44487)
+    --
+    -- >>> settingsRstRateLimit
+    -- 4
     }
 
 -- | Default settings.
@@ -113,4 +137,8 @@
         , settingsUseEarlyData = False
         , settingsOpenClientSocket = openClientSocket
         , settingsOnServerFinished = \_ -> return ()
+        , settingsPingRateLimit = 10
+        , settingsEmptyFrameRateLimit = 4
+        , settingsSettingsRateLimit = 4
+        , settingsRstRateLimit = 4
         }
diff --git a/Network/HTTP2/TLS/Server.hs b/Network/HTTP2/TLS/Server.hs
--- a/Network/HTTP2/TLS/Server.hs
+++ b/Network/HTTP2/TLS/Server.hs
@@ -29,6 +29,12 @@
     settingsSessionManager,
     settingsEarlyDataSize,
 
+    -- ** Rate limits
+    settingsPingRateLimit,
+    settingsEmptyFrameRateLimit,
+    settingsSettingsRateLimit,
+    settingsRstRateLimit,
+
     -- * IO backend
     IOBackend,
     send,
@@ -54,6 +60,10 @@
     initialWindowSize,
     maxConcurrentStreams,
     numberOfWorkers,
+    pingRateLimit,
+    emptyFrameRateLimit,
+    settingsRateLimit,
+    rstRateLimit,
     settings,
  )
 import qualified Network.HTTP2.Server as H2Server
@@ -174,6 +184,10 @@
                 (settings defaultServerConfig)
                     { initialWindowSize = settingsStreamWindowSize
                     , maxConcurrentStreams = Just settingsConcurrentStreams
+                    , pingRateLimit = settingsPingRateLimit
+                    , emptyFrameRateLimit = settingsEmptyFrameRateLimit
+                    , settingsRateLimit = settingsSettingsRateLimit
+                    , rstRateLimit = settingsRstRateLimit
                     }
             }
 
@@ -203,6 +217,10 @@
                 (settings defaultServerConfig)
                     { initialWindowSize = settingsStreamWindowSize
                     , maxConcurrentStreams = Just settingsConcurrentStreams
+                    , pingRateLimit = settingsPingRateLimit
+                    , emptyFrameRateLimit = settingsEmptyFrameRateLimit
+                    , settingsRateLimit = settingsSettingsRateLimit
+                    , rstRateLimit = settingsRstRateLimit
                     }
             }
 
diff --git a/Network/HTTP2/TLS/Server/Settings.hs b/Network/HTTP2/TLS/Server/Settings.hs
--- a/Network/HTTP2/TLS/Server/Settings.hs
+++ b/Network/HTTP2/TLS/Server/Settings.hs
@@ -72,6 +72,30 @@
     --
     -- >>> settingsEarlyDataSize defaultSettings
     -- 0
+
+    , settingsPingRateLimit :: Int
+    -- ^ Maximum number of pings allowed per second (CVE-2019-9512)
+    --
+    -- >>> settingsPingRateLimit defaultSettings
+    -- 10
+
+    , settingsEmptyFrameRateLimit :: Int
+    -- ^ Maximum number of empty data frames allowed per second (CVE-2019-9518)
+    --
+    -- >>> settingsEmptyFrameRateLimit defaultSettings
+    -- 4
+
+    , settingsSettingsRateLimit :: Int
+    -- ^ Maximum number of settings frames allowed per second (CVE-2019-9515)
+    --
+    -- >>> settingsSettingsRateLimit defaultSettings
+    -- 4
+
+    , settingsRstRateLimit :: Int
+    -- ^ Maximum number of reset frames allowed per second (CVE-2023-44487)
+    --
+    -- >>> settingsRstRateLimit
+    -- 4
     }
 
 -- | Default settings.
@@ -90,4 +114,8 @@
         , settingsConnectionWindowSize = defaultMaxData
         , settingsSessionManager = noSessionManager
         , settingsEarlyDataSize = 0
+        , settingsPingRateLimit = 10
+        , settingsEmptyFrameRateLimit = 4
+        , settingsSettingsRateLimit = 4
+        , settingsRstRateLimit = 4
         }
diff --git a/http2-tls.cabal b/http2-tls.cabal
--- a/http2-tls.cabal
+++ b/http2-tls.cabal
@@ -1,6 +1,6 @@
 cabal-version: >=1.10
 name:          http2-tls
-version:       0.4.0
+version:       0.4.1
 license:       BSD3
 license-file:  LICENSE
 maintainer:    Kazu Yamamoto <kazu@iij.ad.jp>
@@ -41,7 +41,7 @@
         crypton-x509-store >=1.6 && <1.7,
         crypton-x509-validation >=1.6 && <1.7,
         data-default-class >=0.1 && <0.2,
-        http2 >=5.1 && <5.3,
+        http2 >=5.3 && <5.4,
         network >=3.1.4,
         network-control >=0.1 && <0.2,
         network-run >=0.4 && <0.5,