The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Project Subscriptions

Vendors Products
Http Server Subscribe
Opensearch Data Prepper Subscribe
Traffic Server Subscribe
Swiftnio Http\/2 Subscribe
Caddyserver Subscribe
Business Process Automation Subscribe
Connected Mobile Experiences Subscribe
Crosswork Data Gateway Subscribe
Crosswork Situation Manager Subscribe
Crosswork Zero Touch Provisioning Subscribe
Data Center Network Manager Subscribe
Enterprise Chat And Email Subscribe
Expressway Subscribe
Firepower Threat Defense Subscribe
Fog Director Subscribe
Iot Field Network Director Subscribe
Nexus 3016 Subscribe
Nexus 3016q Subscribe
Nexus 3048 Subscribe
Nexus 3064 Subscribe
Nexus 3064-32t Subscribe
Nexus 3064-t Subscribe
Nexus 3064-x Subscribe
Nexus 3064t Subscribe
Nexus 3064x Subscribe
Nexus 3100 Subscribe
Nexus 3100-v Subscribe
Nexus 3100-z Subscribe
Nexus 3100v Subscribe
Nexus 31108pc-v Subscribe
Nexus 31108pv-v Subscribe
Nexus 31108tc-v Subscribe
Nexus 31128pq Subscribe
Nexus 3132c-z Subscribe
Nexus 3132q Subscribe
Nexus 3132q-v Subscribe
Nexus 3132q-x Subscribe
Nexus 3132q-x\/3132q-xl Subscribe
Nexus 3132q-xl Subscribe
Nexus 3164q Subscribe
Nexus 3172 Subscribe
Nexus 3172pq Subscribe
Nexus 3172pq-xl Subscribe
Nexus 3172pq\/pq-xl Subscribe
Nexus 3172tq Subscribe
Nexus 3172tq-32t Subscribe
Nexus 3172tq-xl Subscribe
Nexus 3200 Subscribe
Nexus 3232 Subscribe
Nexus 3232c Subscribe
Nexus 3232c Subscribe
Nexus 3264c-e Subscribe
Nexus 3264q Subscribe
Nexus 3400 Subscribe
Nexus 3408-s Subscribe
Nexus 34180yc Subscribe
Nexus 34200yc-sm Subscribe
Nexus 3432d-s Subscribe
Nexus 3464c Subscribe
Nexus 3500 Subscribe
Nexus 3524 Subscribe
Nexus 3524-x Subscribe
Nexus 3524-x\/xl Subscribe
Nexus 3524-xl Subscribe
Nexus 3548 Subscribe
Nexus 3548-x Subscribe
Nexus 3548-x\/xl Subscribe
Nexus 3548-xl Subscribe
Nexus 3600 Subscribe
Nexus 36180yc-r Subscribe
Nexus 3636c-r Subscribe
Nexus 9000v Subscribe
Nexus 9200 Subscribe
Nexus 9200yc Subscribe
Nexus 92160yc-x Subscribe
Nexus 92160yc Switch Subscribe
Nexus 9221c Subscribe
Nexus 92300yc Subscribe
Nexus 92300yc Switch Subscribe
Nexus 92304qc Subscribe
Nexus 92304qc Switch Subscribe
Nexus 9232e Subscribe
Nexus 92348gc-x Subscribe
Nexus 9236c Subscribe
Nexus 9236c Switch Subscribe
Nexus 9272q Subscribe
Nexus 9272q Switch Subscribe
Nexus 9300 Subscribe
Nexus 93108tc-ex Subscribe
Nexus 93108tc-ex-24 Subscribe
Nexus 93108tc-ex Switch Subscribe
Nexus 93108tc-fx Subscribe
Nexus 93108tc-fx-24 Subscribe
Nexus 93108tc-fx3h Subscribe
Nexus 93108tc-fx3p Subscribe
Nexus 93120tx Subscribe
Nexus 93120tx Switch Subscribe
Nexus 93128 Subscribe
Nexus 93128tx Subscribe
Nexus 93128tx Switch Subscribe
Nexus 9316d-gx Subscribe
Nexus 93180lc-ex Subscribe
Nexus 93180lc-ex Switch Subscribe
Nexus 93180tc-ex Subscribe
Nexus 93180yc-ex Subscribe
Nexus 93180yc-ex-24 Subscribe
Nexus 93180yc-ex Switch Subscribe
Nexus 93180yc-fx Subscribe
Nexus 93180yc-fx-24 Subscribe
Nexus 93180yc-fx3 Subscribe
Nexus 93180yc-fx3h Subscribe
Nexus 93180yc-fx3s Subscribe
Nexus 93216tc-fx2 Subscribe
Nexus 93240tc-fx2 Subscribe
Nexus 93240yc-fx2 Subscribe
Nexus 9332c Subscribe
Nexus 9332d-gx2b Subscribe
Nexus 9332d-h2r Subscribe
Nexus 9332pq Subscribe
Nexus 9332pq Switch Subscribe
Nexus 93360yc-fx2 Subscribe
Nexus 9336c-fx2 Subscribe
Nexus 9336c-fx2-e Subscribe
Nexus 9336pq Subscribe
Nexus 9336pq Aci Subscribe
Nexus 9336pq Aci Spine Subscribe
Nexus 9336pq Aci Spine Switch Subscribe
Nexus 9348d-gx2a Subscribe
Nexus 9348gc-fx3 Subscribe
Nexus 9348gc-fxp Subscribe
Nexus 93600cd-gx Subscribe
Nexus 9364c Subscribe
Nexus 9364c-gx Subscribe
Nexus 9364d-gx2a Subscribe
Nexus 9372px Subscribe
Nexus 9372px-e Subscribe
Nexus 9372px-e Switch Subscribe
Nexus 9372px Switch Subscribe
Nexus 9372tx Subscribe
Nexus 9372tx-e Subscribe
Nexus 9372tx-e Switch Subscribe
Nexus 9372tx Switch Subscribe
Nexus 9396px Subscribe
Nexus 9396px Switch Subscribe
Nexus 9396tx Subscribe
Nexus 9396tx Switch Subscribe
Nexus 9408 Subscribe
Nexus 9432pq Subscribe
Nexus 9500 Subscribe
Nexus 9500 16-slot Subscribe
Nexus 9500 4-slot Subscribe
Nexus 9500 8-slot Subscribe
Nexus 9500 Supervisor A Subscribe
Nexus 9500 Supervisor A\+ Subscribe
Nexus 9500 Supervisor B Subscribe
Nexus 9500 Supervisor B\+ Subscribe
Nexus 9500r Subscribe
Nexus 9504 Subscribe
Nexus 9504 Switch Subscribe
Nexus 9508 Subscribe
Nexus 9508 Switch Subscribe
Nexus 9516 Subscribe
Nexus 9516 Switch Subscribe
Nexus 9536pq Subscribe
Nexus 9636pq Subscribe
Nexus 9716d-gx Subscribe
Nexus 9736pq Subscribe
Nexus 9800 Subscribe
Nexus 9804 Subscribe
Nexus 9808 Subscribe
Prime Access Registrar Subscribe
Prime Cable Provisioning Subscribe
Prime Infrastructure Subscribe
Prime Network Registrar Subscribe
Secure Dynamic Attributes Connector Subscribe
Secure Malware Analytics Subscribe
Secure Web Appliance Subscribe
Secure Web Appliance Firmware Subscribe
Telepresence Video Communication Server Subscribe
Ultra Cloud Core - Policy Control Function Subscribe
Ultra Cloud Core - Serving Gateway Function Subscribe
Ultra Cloud Core - Session Management Function Subscribe
Unified Attendant Console Advanced Subscribe
Unified Contact Center Domain Manager Subscribe
Unified Contact Center Enterprise Subscribe
Unified Contact Center Enterprise - Live Data Server Subscribe
Unified Contact Center Management Portal Subscribe
Debian Linux Subscribe
Eclipse Subscribe
Envoyproxy Subscribe
Big-ip Access Policy Manager Subscribe
Big-ip Advanced Firewall Manager Subscribe
Big-ip Advanced Web Application Firewall Subscribe
Big-ip Analytics Subscribe
Big-ip Application Acceleration Manager Subscribe
Big-ip Application Security Manager Subscribe
Big-ip Application Visibility And Reporting Subscribe
Big-ip Carrier-grade Nat Subscribe
Big-ip Ddos Hybrid Defender Subscribe
Big-ip Domain Name System Subscribe
Big-ip Fraud Protection Service Subscribe
Big-ip Global Traffic Manager Subscribe
Big-ip Link Controller Subscribe
Big-ip Local Traffic Manager Subscribe
Big-ip Next Subscribe
Big-ip Next Service Proxy For Kubernetes Subscribe
Big-ip Policy Enforcement Manager Subscribe
Big-ip Ssl Orchestrator Subscribe
Big-ip Webaccelerator Subscribe
Big-ip Websafe Subscribe
Nginx Ingress Controller Subscribe
Nginx Plus Subscribe
Facebook Subscribe
Proxygen Subscribe
Fedoraproject Subscribe
Jenkins Subscribe
Jenkins Subscribe
Kazu-yamamoto Subscribe
Kong Gateway Subscribe
Linecorp Subscribe
Armeria Subscribe
Linkerd Subscribe
Linkerd Subscribe
Microsoft Subscribe
Asp.net Core Subscribe
Azure Kubernetes Service Subscribe
Cbl-mariner Subscribe
Visual Studio 2022 Subscribe
Windows 10 1607 Subscribe
Windows 10 1809 Subscribe
Windows 10 21h2 Subscribe
Windows 10 22h2 Subscribe
Windows 11 21h2 Subscribe
Windows 11 22h2 Subscribe
Windows Server 2016 Subscribe
Windows Server 2019 Subscribe
Windows Server 2022 Subscribe
Astra Control Center Subscribe
Oncommand Insight Subscribe
Nghttp2 Subscribe
Nghttp2 Subscribe
Node.js Subscribe
Openresty Subscribe
Openresty Subscribe
Projectcontour Subscribe
Contour Subscribe
3scale Api Management Platform Subscribe
Advanced Cluster Management For Kubernetes Subscribe
Advanced Cluster Security Subscribe
Amq Broker Subscribe
Amq Streams Subscribe
Ansible Automation Platform Subscribe
Ansible Automation Platform Cloud Billing Subscribe
Assisted Installer Subscribe
Aws Lb Optr Subscribe
Build Of Optaplanner Subscribe
Build Of Quarkus Subscribe
Camel K Subscribe
Camel Quarkus Subscribe
Camel Spring Boot Subscribe
Ceph Storage Subscribe
Cert-manager Operator For Red Hat Openshift Subscribe
Cert Manager Subscribe
Certification For Red Hat Enterprise Linux Subscribe
Container Native Virtualization Subscribe
Cost Management Subscribe
Cryostat Subscribe
Decision Manager Subscribe
Devtools Subscribe
Enterprise Linux Subscribe
Ext Dns Optr Subscribe
Fence Agents Remediation Operator Subscribe
Integration Camel For Spring Boot Subscribe
Integration Camel K Subscribe
Integration Service Registry Subscribe
Jboss A-mq Subscribe
Jboss A-mq Streams Subscribe
Jboss Core Services Subscribe
Jboss Data Grid Subscribe
Jboss Enterprise Application Platform Subscribe
Jboss Enterprise Web Server Subscribe
Jboss Fuse Subscribe
Jbosseapxp Subscribe
Kernel Module Management Subscribe
Kube Descheduler Operator Subscribe
Logging Subscribe
Logging Subsystem For Red Hat Openshift Subscribe
Machine Deletion Remediation Operator Subscribe
Migration Toolkit Applications Subscribe
Migration Toolkit For Applications Subscribe
Migration Toolkit For Containers Subscribe
Migration Toolkit For Virtualization Subscribe
Migration Toolkit Runtimes Subscribe
Migration Toolkit Virtualization Subscribe
Multicluster Engine Subscribe
Network Observ Optr Subscribe
Network Observability Operator Subscribe
Node Healthcheck Operator Subscribe
Node Maintenance Operator Subscribe
Ocp Tools Subscribe
Openshift Subscribe
Openshift Api Data Protection Subscribe
Openshift Api For Data Protection Subscribe
Openshift Application Runtimes Subscribe
Openshift Container Platform Subscribe
Openshift Container Platform Assisted Installer Subscribe
Openshift Custom Metrics Autoscaler Subscribe
Openshift Data Foundation Subscribe
Openshift Data Science Subscribe
Openshift Dev Spaces Subscribe
Openshift Developer Tools And Services Subscribe
Openshift Devspaces Subscribe
Openshift Distributed Tracing Subscribe
Openshift Gitops Subscribe
Openshift Pipelines Subscribe
Openshift Sandboxed Containers Subscribe
Openshift Secondary Scheduler Subscribe
Openshift Secondary Scheduler Operator Subscribe
Openshift Serverless Subscribe
Openshift Service Mesh Subscribe
Openshift Virtualization Subscribe
Openstack Subscribe
Openstack Platform Subscribe
Optaplanner Subscribe
Process Automation Subscribe
Quarkus Subscribe
Red Hat Single Sign On Subscribe
Rhel Aus Subscribe
Rhel Dotnet Subscribe
Rhel E4s Subscribe
Rhel Eus Subscribe
Rhel Satellite Client Subscribe
Rhel Software Collections Subscribe
Rhel Tus Subscribe
Rhosemc Subscribe
Run Once Duration Override Operator Subscribe
Satellite Subscribe
Self Node Remediation Operator Subscribe
Serverless Subscribe
Service Interconnect Subscribe
Service Mesh Subscribe
Service Registry Subscribe
Service Telemetry Framework Subscribe
Single Sign-on Subscribe
Support For Spring Boot Subscribe
Web Terminal Subscribe
Workload Availability Fence Agents Remediation Subscribe
Workload Availability Machine Deletion Remediation Subscribe
Workload Availability Nmo Subscribe
Workload Availability Node Healthcheck Subscribe
Workload Availability Snr Subscribe
Traefik Subscribe
Traefik Subscribe
Varnish Cache Project Subscribe
Varnish Cache Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-3617-1 tomcat9 security update
Debian DLA Debian DLA DLA-3617-2 tomcat9 regression update
Debian DLA Debian DLA DLA-3621-1 nghttp2 security update
Debian DLA Debian DLA DLA-3638-1 h2o security update
Debian DLA Debian DLA DLA-3641-1 jetty9 security update
Debian DLA Debian DLA DLA-3645-1 trafficserver security update
Debian DLA Debian DLA DLA-3656-1 netty security update
Debian DSA Debian DSA DSA-5521-1 tomcat10 security update
Debian DSA Debian DSA DSA-5522-1 tomcat9 security update
Debian DSA Debian DSA DSA-5522-2 tomcat9 regression update
Debian DSA Debian DSA DSA-5522-3 tomcat9 regression update
Debian DSA Debian DSA DSA-5540-1 jetty9 security update
Debian DSA Debian DSA DSA-5549-1 trafficserver security update
Debian DSA Debian DSA DSA-5558-1 netty security update
Debian DSA Debian DSA DSA-5570-1 nghttp2 security update
Github GHSA Github GHSA GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack
Ubuntu USN Ubuntu USN USN-6427-1 .NET vulnerability
Ubuntu USN Ubuntu USN USN-6427-2 .NET vulnerability
Ubuntu USN Ubuntu USN USN-6438-1 .NET vulnerabilities
Ubuntu USN Ubuntu USN USN-6505-1 nghttp2 vulnerability
Ubuntu USN Ubuntu USN USN-6574-1 Go vulnerabilities
Ubuntu USN Ubuntu USN USN-6754-1 nghttp2 vulnerabilities
Ubuntu USN Ubuntu USN USN-6994-1 Netty vulnerabilities
Ubuntu USN Ubuntu USN USN-7067-1 HAProxy vulnerability
Ubuntu USN Ubuntu USN USN-7410-1 Tomcat vulnerability
Ubuntu USN Ubuntu USN USN-7469-1 Apache Traffic Server vulnerability
Ubuntu USN Ubuntu USN USN-7469-2 Apache Tomcat vulnerability
Ubuntu USN Ubuntu USN USN-7469-3 Node.js vulnerability
Ubuntu USN Ubuntu USN USN-7469-4 H2O vulnerability
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
http://www.openwall.com/lists/oss-security/2023/10/10/6 cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2023/10/10/7 cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2023/10/13/4 cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2023/10/13/9 cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2023/10/18/4 cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2023/10/18/8 cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2023/10/19/6 cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2023/10/20/8 cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2025/08/13/6 cve-icon
https://access.redhat.com/security/cve/cve-2023-44487 cve-icon cve-icon
https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/ cve-icon cve-icon
https://aws.amazon.com/security/security-bulletins/AWS-2023-011/ cve-icon cve-icon
https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ cve-icon cve-icon
https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/ cve-icon cve-icon
https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/ cve-icon cve-icon
https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack cve-icon cve-icon
https://blog.vespa.ai/cve-2023-44487/ cve-icon cve-icon
https://bugzilla.proxmox.com/show_bug.cgi?id=4988 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2242803 cve-icon cve-icon
https://bugzilla.suse.com/show_bug.cgi?id=1216123 cve-icon cve-icon
https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 cve-icon cve-icon
https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/ cve-icon cve-icon
https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack cve-icon cve-icon
https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125 cve-icon cve-icon
https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715 cve-icon cve-icon
https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve cve-icon cve-icon
https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764 cve-icon cve-icon
https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088 cve-icon cve-icon
https://github.com/Azure/AKS/issues/3947 cve-icon cve-icon
https://github.com/Kong/kong/discussions/11741 cve-icon cve-icon
https://github.com/advisories/GHSA-qppj-fm5r-hxr3 cve-icon cve-icon
https://github.com/advisories/GHSA-vx74-f528-fxqg cve-icon cve-icon
https://github.com/advisories/GHSA-xpw8-rcwv-8f8p cve-icon cve-icon
https://github.com/akka/akka-http/issues/4323 cve-icon cve-icon
https://github.com/alibaba/tengine/issues/1872 cve-icon cve-icon
https://github.com/apache/apisix/issues/10320 cve-icon cve-icon
https://github.com/apache/httpd-site/pull/10 cve-icon cve-icon
https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113 cve-icon cve-icon
https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2 cve-icon cve-icon
https://github.com/apache/trafficserver/pull/10564 cve-icon cve-icon
https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487 cve-icon cve-icon
https://github.com/bcdannyboy/CVE-2023-44487 cve-icon cve-icon
https://github.com/caddyserver/caddy/issues/5877 cve-icon cve-icon
https://github.com/caddyserver/caddy/releases/tag/v2.7.5 cve-icon cve-icon
https://github.com/dotnet/announcements/issues/277 cve-icon cve-icon cve-icon
https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73 cve-icon cve-icon
https://github.com/eclipse/jetty.project/issues/10679 cve-icon cve-icon
https://github.com/envoyproxy/envoy/pull/30055 cve-icon cve-icon
https://github.com/etcd-io/etcd/issues/16740 cve-icon cve-icon
https://github.com/facebook/proxygen/pull/466 cve-icon cve-icon
https://github.com/golang/go/issues/63417 cve-icon cve-icon
https://github.com/grpc/grpc-go/pull/6703 cve-icon cve-icon
https://github.com/grpc/grpc/releases/tag/v1.59.2 cve-icon cve-icon
https://github.com/h2o/h2o/pull/3291 cve-icon cve-icon
https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf cve-icon cve-icon
https://github.com/haproxy/haproxy/issues/2312 cve-icon cve-icon
https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244 cve-icon cve-icon
https://github.com/junkurihara/rust-rpxy/issues/97 cve-icon cve-icon
https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1 cve-icon cve-icon
https://github.com/kazu-yamamoto/http2/issues/93 cve-icon cve-icon
https://github.com/kubernetes/kubernetes/pull/121120 cve-icon cve-icon
https://github.com/line/armeria/pull/5232 cve-icon cve-icon
https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632 cve-icon cve-icon
https://github.com/micrictor/http2-rst-stream cve-icon cve-icon
https://github.com/microsoft/CBL-Mariner/pull/6381 cve-icon cve-icon
https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61 cve-icon cve-icon
https://github.com/nghttp2/nghttp2/pull/1961 cve-icon cve-icon
https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0 cve-icon cve-icon
https://github.com/ninenines/cowboy/issues/1615 cve-icon cve-icon
https://github.com/nodejs/node/pull/50121 cve-icon cve-icon
https://github.com/openresty/openresty/issues/930 cve-icon cve-icon
https://github.com/opensearch-project/data-prepper/issues/3474 cve-icon cve-icon
https://github.com/oqtane/oqtane.framework/discussions/3367 cve-icon cve-icon
https://github.com/projectcontour/contour/pull/5826 cve-icon cve-icon
https://github.com/tempesta-tech/tempesta/issues/1986 cve-icon cve-icon
https://github.com/varnishcache/varnish-cache/issues/3996 cve-icon cve-icon
https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo cve-icon cve-icon
https://istio.io/latest/news/security/istio-security-2023-004/ cve-icon cve-icon
https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/ cve-icon cve-icon
https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/ cve-icon cve-icon
https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html cve-icon cve-icon
https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html cve-icon cve-icon
https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html cve-icon cve-icon
https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/ cve-icon cve-icon
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487 cve-icon cve-icon
https://my.f5.com/manage/s/article/K000137106 cve-icon cve-icon
https://netty.io/news/2023/10/10/4-1-100-Final.html cve-icon cve-icon
https://news.ycombinator.com/item?id=37830987 cve-icon cve-icon
https://news.ycombinator.com/item?id=37830998 cve-icon cve-icon
https://news.ycombinator.com/item?id=37831062 cve-icon cve-icon
https://news.ycombinator.com/item?id=37837043 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-44487 cve-icon
https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/ cve-icon cve-icon
https://pkg.go.dev/vuln/GO-2023-2102 cve-icon
https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected cve-icon cve-icon
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ cve-icon cve-icon
https://security.gentoo.org/glsa/202311-09 cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20231016-0001/ cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20240426-0007/ cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20240621-0006/ cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20240621-0007/ cve-icon cve-icon
https://security.paloaltonetworks.com/CVE-2023-44487 cve-icon cve-icon
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14 cve-icon cve-icon
https://ubuntu.com/security/CVE-2023-44487 cve-icon cve-icon
https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/ cve-icon cve-icon
https://www.cisa.gov/known-exploited-vulnerabilities-catalog cve-icon
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487 cve-icon cve-icon
https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487 cve-icon cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-44487 cve-icon
https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event cve-icon cve-icon
https://www.debian.org/security/2023/dsa-5521 cve-icon cve-icon
https://www.debian.org/security/2023/dsa-5522 cve-icon cve-icon
https://www.debian.org/security/2023/dsa-5540 cve-icon cve-icon
https://www.debian.org/security/2023/dsa-5549 cve-icon cve-icon
https://www.debian.org/security/2023/dsa-5558 cve-icon cve-icon
https://www.debian.org/security/2023/dsa-5570 cve-icon cve-icon
https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 cve-icon cve-icon
https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/ cve-icon cve-icon
https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ cve-icon cve-icon cve-icon
https://www.openwall.com/lists/oss-security/2023/10/10/6 cve-icon cve-icon
https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack cve-icon cve-icon
https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/ cve-icon cve-icon
https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause cve-icon
History

Tue, 04 Nov 2025 22:30:00 +0000

Type Values Removed Values Added
References

Tue, 21 Oct 2025 23:15:00 +0000


Tue, 21 Oct 2025 20:30:00 +0000


Tue, 21 Oct 2025 19:30:00 +0000


Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.94434}

epss

{'score': 0.94437}


Mon, 14 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.94437}

epss

{'score': 0.94434}


Wed, 02 Jul 2025 02:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.13::el9

Tue, 17 Jun 2025 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat stf
CPEs cpe:/a:redhat:service_telemetry_framework:1.5::el8 cpe:/a:redhat:stf:1.5::el8
Vendors & Products Redhat stf

Wed, 11 Jun 2025 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Cisco business Process Automation
Cisco crosswork Situation Manager
CPEs cpe:2.3:a:cisco:crosswork_data_gateway:5.0:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
cpe:2.3:a:cisco:business_process_automation:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:crosswork_situation_manager:-:*:*:*:*:*:*:*
Vendors & Products Cisco business Process Automation
Cisco crosswork Situation Manager

Sat, 07 Jun 2025 20:15:00 +0000


Wed, 28 May 2025 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat workload Availability Snr
CPEs cpe:/a:redhat:workload_availability_self_node_remediation:0.5::el8
cpe:/a:redhat:workload_availability_self_node_remediation:0.7::el8
cpe:/a:redhat:workload_availability_snr:0.5::el8
cpe:/a:redhat:workload_availability_snr:0.7::el8
Vendors & Products Redhat workload Availability Self Node Remediation
Redhat workload Availability Snr

Fri, 07 Mar 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2023-10-10'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Fri, 07 Mar 2025 18:30:00 +0000

Type Values Removed Values Added
References

Thu, 13 Feb 2025 00:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat workload Availability Nmo
CPEs cpe:/a:redhat:workload_availability_node_maintenance:5.0::el8
cpe:/a:redhat:workload_availability_node_maintenance:5.2::el8
cpe:/a:redhat:workload_availability_nmo:5.0::el8
cpe:/a:redhat:workload_availability_nmo:5.2::el8
Vendors & Products Redhat workload Availability Node Maintenance
Redhat workload Availability Nmo

Sun, 08 Sep 2024 18:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.6::el8
cpe:/a:redhat:multicluster_engine:2.1::el8
cpe:/a:redhat:openshift_distributed_tracing:2.9::el8

Mon, 26 Aug 2024 06:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat 3scale
CPEs cpe:/a:redhat:3scale:2.13::el7
Vendors & Products Redhat 3scale

Mon, 19 Aug 2024 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat assisted Installer
CPEs cpe:/a:redhat:acm:2.6::el8
cpe:/a:redhat:multicluster_engine:2.1::el8
cpe:/a:redhat:openshift_distributed_tracing:2.9::el8
cpe:/a:redhat:assisted_installer:2.0::el8
Vendors & Products Redhat assisted Installer

Mon, 19 Aug 2024 08:30:00 +0000


Wed, 14 Aug 2024 20:15:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Wed, 14 Aug 2024 01:00:00 +0000

Type Values Removed Values Added
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2025-11-04T21:08:27.383Z

Reserved: 2023-09-29T00:00:00.000Z

Link: CVE-2023-44487

cve-icon Vulnrichment

Updated: 2025-11-04T21:08:27.383Z

cve-icon NVD

Status : Analyzed

Published: 2023-10-10T14:15:10.883

Modified: 2025-11-07T19:00:41.810

Link: CVE-2023-44487

cve-icon Redhat

Severity : Important

Publid Date: 2023-10-10T00:00:00Z

Links: CVE-2023-44487 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses