CVE-2023-44487
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
- Score
- CVSS 3.1 7.5 High
- Status
- Analyzed - cve@mitre.org
- Published
- 2023-10-10
- Last modified
- 2026-10-14
- Known exploited (CISA KEV)
- since 2023-10-10, action due 2023-10-31: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Weaknesses
- CWE-400
Affected products
- Http Server (Akka)
- Opensearch Data Prepper (Amazon)
- Apisix (Apache)
- Solr (Apache)
- Tomcat (Apache)
- Traffic Server (Apache)
- Swiftnio Http/2 (Apple)
- Caddy (Caddyserver)
- Business Process Automation (Cisco)
- Connected Mobile Experiences (Cisco)
- Crosswork Data Gateway (Cisco)
- Crosswork Situation Manager (Cisco)
- Crosswork Zero Touch Provisioning (Cisco)
- Data Center Network Manager (Cisco)
- Enterprise Chat And Email (Cisco)
- Expressway (Cisco)
- Fog Director (Cisco)
- Ios Xe (Cisco)
- Ios Xr (Cisco)
- Iot Field Network Director (Cisco)
- Nx-os (Cisco)
- Prime Access Registrar (Cisco)
- Prime Cable Provisioning (Cisco)
- Prime Infrastructure (Cisco)
- Prime Network Registrar (Cisco)
- Secure Dynamic Attributes Connector (Cisco)
- Secure Firewall Threat Defense (Cisco)
- Secure Malware Analytics (Cisco)
- Secure Web Appliance Firmware (Cisco)
- Telepresence Video Communication Server (Cisco)
- Ultra Cloud Core - Policy Control Function (Cisco)
- Ultra Cloud Core - Serving Gateway Function (Cisco)
- Ultra Cloud Core - Session Management Function (Cisco)
- Unified Attendant Console Advanced (Cisco)
- Unified Contact Center Domain Manager (Cisco)
- Unified Contact Center Enterprise (Cisco)
- Unified Contact Center Enterprise - Live Data Server (Cisco)
- Unified Contact Center Management Portal (Cisco)
- Debian Linux (Debian)
- H2o (Dena)
- Jetty (Eclipse)
- Envoy (Envoyproxy)
- Big-ip Access Policy Manager (F5)
- Big-ip Advanced Firewall Manager (F5)
- Big-ip Advanced Web Application Firewall (F5)
- Big-ip Analytics (F5)
- Big-ip Application Acceleration Manager (F5)
- Big-ip Application Security Manager (F5)
- Big-ip Application Visibility And Reporting (F5)
- Big-ip Carrier-grade Nat (F5)
- Big-ip Ddos Hybrid Defender (F5)
- Big-ip Domain Name System (F5)
- Big-ip Fraud Protection Service (F5)
- Big-ip Global Traffic Manager (F5)
- Big-ip Link Controller (F5)
- Big-ip Local Traffic Manager (F5)
- Big-ip Next (F5)
- Big-ip Next Service Proxy For Kubernetes (F5)
- Big-ip Policy Enforcement Manager (F5)
- Big-ip Ssl Orchestrator (F5)
- Big-ip Webaccelerator (F5)
- Big-ip Websafe (F5)
- Nginx (F5)
- Nginx Ingress Controller (F5)
- Nginx Plus (F5)
- Proxygen (Facebook)
- Fedora (Fedoraproject)
- Go (Golang)
- Http2 (Golang)
- Networking (Golang)
- Grpc (Grpc)
- Http (Ietf)
- Istio (Istio)
- Jenkins (Jenkins)
- Http2 (Kazu-yamamoto)
- Kong Gateway (Konghq)
- Armeria (Linecorp)
- Linkerd (Linkerd)
- .net (Microsoft)
- Asp.net Core (Microsoft)
- Azure Kubernetes Service (Microsoft)
- Cbl-mariner (Microsoft)
- Visual Studio 2022 (Microsoft)
- Windows 10 1607 (Microsoft)
- Windows 10 1809 (Microsoft)
- Windows 10 21h2 (Microsoft)
- Windows 10 22h2 (Microsoft)
- Windows 11 21h2 (Microsoft)
- Windows 11 22h2 (Microsoft)
- Windows Server 2016 (Microsoft)
- Windows Server 2019 (Microsoft)
- Windows Server 2022 (Microsoft)
- Astra Control Center (Netapp)
- Oncommand Insight (Netapp)
- Netty (Netty)
- Nghttp2 (Nghttp2)
- Node.js (Nodejs)
- Openresty (Openresty)
- Contour (Projectcontour)
- 3scale Api Management Platform (Redhat)
References
- http://www.openwall.com/lists/oss-security/2023/10/10/6
- http://www.openwall.com/lists/oss-security/2023/10/10/7
- http://www.openwall.com/lists/oss-security/2023/10/13/4
- http://www.openwall.com/lists/oss-security/2023/10/13/9
- http://www.openwall.com/lists/oss-security/2023/10/18/4
- http://www.openwall.com/lists/oss-security/2023/10/18/8
- http://www.openwall.com/lists/oss-security/2023/10/19/6
- http://www.openwall.com/lists/oss-security/2023/10/20/8
- https://access.redhat.com/security/cve/cve-2023-44487
- https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/
- https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
- https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/
- https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/
- https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack
- https://blog.vespa.ai/cve-2023-44487/
- https://bugzilla.proxmox.com/show_bug.cgi?id=4988
- https://bugzilla.redhat.com/show_bug.cgi?id=2242803
- https://bugzilla.suse.com/show_bug.cgi?id=1216123
- https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9
- https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-m…
- https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack
- https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125
- https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-servic…
- https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve
- https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764
- https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088
- https://github.com/Azure/AKS/issues/3947
- https://github.com/Kong/kong/discussions/11741
- https://github.com/advisories/GHSA-qppj-fm5r-hxr3
