CVE-2023-44487
CVE-2023-44487
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 7.5 · High · EPSS 100.0% · In KEV · Public exploit · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
dnsdist Debian:12
- Versions
- 1.7.3-2
- 1.8.0-1
- 1.8.1-1
- 1.8.2-1
- 1.8.2-2
- 1.8.2-3
- 1.8.3-1
- 1.8.3-2
- 1.8.3-3
- 1.9.10-1
- 1.9.3-1
- 1.9.4-1
- 1.9.5-1
- 1.9.6-1
- 1.9.8-1
- 1.9.9-1
- 2.0.0-1
- 2.0.0-2
- 2.0.0-3
- 2.0.0-4
- 2.0.0-5
- 2.0.0-6
- 2.0.0~rc1-1
- 2.0.0~rc1-2
- 2.0.0~rc2-1
- 2.0.1-1
- 2.0.2-1
- 2.0.3-1
- 2.0.4-1
- 2.0.5-1
- 2.0.5-2
- 2.0.5-3
- 2.0.6-1
- 2.1.0-1
- 2.1.0-2
- 2.1.1-1
- 2.1.2-1
- 2.1.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
dnsdist Debian:13
- Affected ranges
- ECOSYSTEM: < 1.8.2-2
Update to 1.8.2-2
dnsdist Debian:14
- Affected ranges
- ECOSYSTEM: < 1.8.2-2
Update to 1.8.2-2
grpc Debian:12
- Versions
- 1.51.1-10
- 1.51.1-3
- 1.51.1-4
- 1.51.1-4.1
- 1.51.1-4.1~exp1
- 1.51.1-5
- 1.51.1-6
- 1.51.1-7
- 1.51.1-8
- 1.51.1-9
- 1.59.5-1
- 1.82.0-1
- 1.83.0-1
- 1.83.0-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
grpc Debian:13
- Versions
- 1.51.1-10
- 1.51.1-6
- 1.51.1-7
- 1.51.1-8
- 1.51.1-9
- 1.59.5-1
- 1.82.0-1
- 1.83.0-1
- 1.83.0-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
grpc Debian:14
- Versions
- 1.51.1-10
- 1.51.1-6
- 1.51.1-7
- 1.51.1-8
- 1.51.1-9
- 1.59.5-1
- 1.82.0-1
- 1.83.0-1
- 1.83.0-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
h2o Debian:12
- Versions
- 2.2.5+dfsg2-10
- 2.2.5+dfsg2-11
- 2.2.5+dfsg2-7
- 2.2.5+dfsg2-8
- 2.2.5+dfsg2-8.1
- 2.2.5+dfsg2-8.1~exp1
- 2.2.5+dfsg2-9
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
haproxy Debian:12
- Affected ranges
- ECOSYSTEM: < 1.8.13-1
Update to 1.8.13-1
haproxy Debian:13
- Affected ranges
- ECOSYSTEM: < 1.8.13-1
Update to 1.8.13-1
haproxy Debian:14
- Affected ranges
- ECOSYSTEM: < 1.8.13-1
Update to 1.8.13-1
jetty9 Debian:12
- Versions
- 9.4.50-4
- 9.4.50-4+deb12u1
- Affected ranges
- ECOSYSTEM: < 9.4.50-4+deb12u2
Update to 9.4.50-4+deb12u2
jetty9 Debian:13
- Affected ranges
- ECOSYSTEM: < 9.4.53-1
Update to 9.4.53-1
jetty9 Debian:14
- Affected ranges
- ECOSYSTEM: < 9.4.53-1
Update to 9.4.53-1
netty Debian:12
- Versions
- 1:4.1.48-7
- Affected ranges
- ECOSYSTEM: < 1:4.1.48-7+deb12u1
Update to 1:4.1.48-7+deb12u1
netty Debian:13
- Affected ranges
- ECOSYSTEM: < 1:4.1.48-8
Update to 1:4.1.48-8
netty Debian:14
- Affected ranges
- ECOSYSTEM: < 1:4.1.48-8
Update to 1:4.1.48-8
nghttp2 Debian:12
- Versions
- 1.52.0-1
- Affected ranges
- ECOSYSTEM: < 1.52.0-1+deb12u1
Update to 1.52.0-1+deb12u1
nghttp2 Debian:13
- Affected ranges
- ECOSYSTEM: < 1.57.0-1
Update to 1.57.0-1
nghttp2 Debian:14
- Affected ranges
- ECOSYSTEM: < 1.57.0-1
Update to 1.57.0-1
nginx Debian:12
- Versions
- 1.22.1-9
- 1.22.1-9+deb12u1
- 1.22.1-9+deb12u10
- 1.22.1-9+deb12u2
- 1.22.1-9+deb12u3
- 1.22.1-9+deb12u4
- 1.22.1-9+deb12u5
- 1.22.1-9+deb12u6
- 1.22.1-9+deb12u7
- 1.22.1-9+deb12u8
- 1.22.1-9+deb12u9
- 1.24.0-1
- 1.24.0-1~exp1
- 1.24.0-2
- 1.26.0-1
- 1.26.0-1~exp1
- 1.26.0-2
- 1.26.0-3
- 1.26.2-1
- 1.26.3-1
- 1.26.3-2
- 1.26.3-3
- 1.28.0-1
- 1.28.0-2
- 1.28.0-3
- 1.28.0-4
- 1.28.0-5
- 1.28.0-6
- 1.28.1-1
- 1.28.1-2
- 1.28.1-3
- 1.28.2-1
- 1.28.2-2
- 1.28.2-3
- 1.28.2-4
- 1.28.3-1
- 1.28.3-2
- 1.30.0-1
- 1.30.0-2
- 1.30.0-3
- 1.30.0-4
- 1.30.1-1
- 1.30.1-2
- 1.30.1-3
- 1.30.1-4
- 1.30.1-5
- 1.30.1-6
- 1.30.1-7
- 1.30.4-1
- 1.30.4-2
- 1.30.4-3
- 1.30.4-4
- 1.30.4-5
- 1.30.4-6
- 1.30.4-7
- 1.30.4-8
- 1.30.6-1
- 1.30.6-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nginx Debian:13
- Affected ranges
- ECOSYSTEM: < 1.24.0-2
Update to 1.24.0-2
nginx Debian:14
- Affected ranges
- ECOSYSTEM: < 1.24.0-2
Update to 1.24.0-2
tomcat10 Debian:12
- Versions
- 10.1.6-1
- Affected ranges
- ECOSYSTEM: < 10.1.6-1+deb12u1
Update to 10.1.6-1+deb12u1
Original sources
- https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73
- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
- https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
- https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack
- https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
- https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/
- https://news.ycombinator.com/item?id=37831062
- https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/
- https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack
- https://github.com/envoyproxy/envoy/pull/30055
- https://github.com/haproxy/haproxy/issues/2312
- https://github.com/eclipse/jetty.project/issues/10679
- https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764
- https://github.com/nghttp2/nghttp2/pull/1961
- https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
- https://github.com/alibaba/tengine/issues/1872
- https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2
- https://news.ycombinator.com/item?id=37830987
- https://news.ycombinator.com/item?id=37830998
- https://github.com/caddyserver/caddy/issues/5877
- https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/
- https://github.com/bcdannyboy/CVE-2023-44487
- https://github.com/grpc/grpc-go/pull/6703
- https://nvd.nist.gov/vuln/detail/CVE-2023-44487