Executive Summary

Informations
Name CVE-2023-44487 First vendor Publication 2023-10-10
Vendor Cve Last vendor Modification 2024-04-26

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Overall CVSS Score 7.5
Base Score 7.5 Environmental Score 7.5
impact SubScore 3.6 Temporal Score 7.5
Exploitabality Sub Score 3.9
 
Attack Vector Network Attack Complexity Low
Privileges Required None User Interaction None
Scope Unchanged Confidentiality Impact None
Integrity Impact None Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score N/A Attack Range N/A
Cvss Impact Score N/A Attack Complexity N/A
Cvss Expoit Score N/A Authentication N/A
Calculate full CVSS 2.0 Vectors scores

Detail

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Application 1
Application 1
Application 56
Application 546
Application 52
Application 1
Application 3
Application 7
Application 3
Application 2
Application 1
Application 1
Application 29
Application 132
Application 2
Application 13
Application 3
Application 1
Application 1
Application 44
Application 16
Application 1
Application 1
Application 43
Application 2
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 6
Application 324
Application 4
Application 147
Application 135
Application 43
Application 137
Application 130
Application 157
Application 6
Application 6
Application 16
Application 132
Application 124
Application 149
Application 146
Application 150
Application 1
Application 1
Application 135
Application 9
Application 103
Application 27
Application 468
Application 1
Application 3
Application 1
Application 166
Application 2
Application 1
Application 6
Application 1
Application 11
Application 658
Application 1
Application 1
Application 1
Application 4
Application 8
Application 10
Application 2
Application 1
Application 9
Application 1
Application 51
Application 1
Application 218
Application 1
Application 1
Application 1
Application 1
Application 2
Application 1
Application 1
Application 1
Application 1
Application 1
Application 2
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 2
Application 2
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 3
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 13
Application 41
Hardware 1
Hardware 4
Hardware 7
Hardware 6
Os 2
Os 1
Os 1049
Os 218
Os 3
Os 2
Os 10
Os 12
Os 13
Os 17
Os 14
Os 9
Os 1
Os 1
Os 1
Os 3

Sources (Detail)

https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://security.gentoo.org/glsa/202311-09
https://security.netapp.com/advisory/ntap-20240426-0007/
https://www.debian.org/security/2023/dsa-5558
https://www.debian.org/security/2023/dsa-5570
Source Url
CONFIRM https://security.netapp.com/advisory/ntap-20231016-0001/
DEBIAN https://www.debian.org/security/2023/dsa-5521
https://www.debian.org/security/2023/dsa-5522
https://www.debian.org/security/2023/dsa-5540
https://www.debian.org/security/2023/dsa-5549
MISC https://access.redhat.com/security/cve/cve-2023-44487
https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol...
https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-a...
https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/
https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-4...
https://blog.vespa.ai/cve-2023-44487/
https://bugzilla.proxmox.com/show_bug.cgi?id=4988
https://bugzilla.redhat.com/show_bug.cgi?id=2242803
https://bugzilla.suse.com/show_bug.cgi?id=1216123
https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6...
https://cloud.google.com/blog/products/identity-security/google-cloud-mitigat...
https://cloud.google.com/blog/products/identity-security/how-it-works-the-nov...
https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125
https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affec...
https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve
https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-htt...
https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088
https://github.com/advisories/GHSA-qppj-fm5r-hxr3
https://github.com/advisories/GHSA-vx74-f528-fxqg
https://github.com/advisories/GHSA-xpw8-rcwv-8f8p
https://github.com/akka/akka-http/issues/4323
https://github.com/alibaba/tengine/issues/1872
https://github.com/apache/apisix/issues/10320
https://github.com/apache/httpd-site/pull/10
https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152...
https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2
https://github.com/apache/trafficserver/pull/10564
https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487
https://github.com/Azure/AKS/issues/3947
https://github.com/bcdannyboy/CVE-2023-44487
https://github.com/caddyserver/caddy/issues/5877
https://github.com/caddyserver/caddy/releases/tag/v2.7.5
https://github.com/dotnet/announcements/issues/277
https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/...
https://github.com/eclipse/jetty.project/issues/10679
https://github.com/envoyproxy/envoy/pull/30055
https://github.com/etcd-io/etcd/issues/16740
https://github.com/facebook/proxygen/pull/466
https://github.com/golang/go/issues/63417
https://github.com/grpc/grpc-go/pull/6703
https://github.com/h2o/h2o/pull/3291
https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf
https://github.com/haproxy/haproxy/issues/2312
https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a...
https://github.com/junkurihara/rust-rpxy/issues/97
https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b...
https://github.com/kazu-yamamoto/http2/issues/93
https://github.com/Kong/kong/discussions/11741
https://github.com/kubernetes/kubernetes/pull/121120
https://github.com/line/armeria/pull/5232
https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae...
https://github.com/micrictor/http2-rst-stream
https://github.com/microsoft/CBL-Mariner/pull/6381
https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
https://github.com/nghttp2/nghttp2/pull/1961
https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0
https://github.com/ninenines/cowboy/issues/1615
https://github.com/nodejs/node/pull/50121
https://github.com/openresty/openresty/issues/930
https://github.com/opensearch-project/data-prepper/issues/3474
https://github.com/oqtane/oqtane.framework/discussions/3367
https://github.com/projectcontour/contour/pull/5826
https://github.com/tempesta-tech/tempesta/issues/1986
https://github.com/varnishcache/varnish-cache/issues/3996
https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo
https://istio.io/latest/news/security/istio-security-2023-004/
https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/
https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q
https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html
https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPL...
https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-str...
https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-den...
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487
https://my.f5.com/manage/s/article/K000137106
https://netty.io/news/2023/10/10/4-1-100-Final.html
https://news.ycombinator.com/item?id=37830987
https://news.ycombinator.com/item?id=37830998
https://news.ycombinator.com/item?id=37831062
https://news.ycombinator.com/item?id=37837043
https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highligh...
https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaff...
https://security.paloaltonetworks.com/CVE-2023-44487
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14
https://ubuntu.com/security/CVE-2023-44487
https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-da...
https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerab...
https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ev...
https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-rese...
https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/
https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-produ...
https://www.openwall.com/lists/oss-security/2023/10/10/6
https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack
https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/
MLIST http://www.openwall.com/lists/oss-security/2023/10/13/4
http://www.openwall.com/lists/oss-security/2023/10/13/9
http://www.openwall.com/lists/oss-security/2023/10/18/4
http://www.openwall.com/lists/oss-security/2023/10/18/8
http://www.openwall.com/lists/oss-security/2023/10/19/6
http://www.openwall.com/lists/oss-security/2023/10/20/8
https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html
https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html
https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html
https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html
https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html
https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
Date Informations
2024-04-26 21:28:18
  • Multiple Updates
2024-04-26 13:27:33
  • Multiple Updates
2024-02-02 21:28:01
  • Multiple Updates
2024-02-02 02:48:57
  • Multiple Updates
2024-02-01 12:31:11
  • Multiple Updates
2023-12-21 21:28:26
  • Multiple Updates
2023-12-14 13:33:34
  • Multiple Updates
2023-12-09 09:27:42
  • Multiple Updates
2023-12-02 09:27:45
  • Multiple Updates
2023-12-01 17:27:41
  • Multiple Updates
2023-11-25 17:27:46
  • Multiple Updates
2023-11-20 00:27:56
  • Multiple Updates
2023-11-19 00:27:49
  • Multiple Updates
2023-11-07 21:27:45
  • Multiple Updates
2023-11-06 09:27:35
  • Multiple Updates
2023-11-06 05:27:36
  • Multiple Updates
2023-11-04 05:27:43
  • Multiple Updates
2023-11-04 02:33:49
  • Multiple Updates
2023-11-04 02:32:56
  • Multiple Updates
2023-11-04 00:27:42
  • Multiple Updates
2023-11-03 13:27:40
  • Multiple Updates
2023-10-31 21:27:46
  • Multiple Updates
2023-10-31 13:27:43
  • Multiple Updates
2023-10-31 05:27:40
  • Multiple Updates
2023-10-29 09:27:42
  • Multiple Updates
2023-10-28 09:27:42
  • Multiple Updates
2023-10-26 13:27:28
  • Multiple Updates
2023-10-26 09:27:43
  • Multiple Updates
2023-10-26 00:27:45
  • Multiple Updates
2023-10-25 21:27:42
  • Multiple Updates
2023-10-24 17:27:42
  • Multiple Updates
2023-10-21 02:32:59
  • Multiple Updates
2023-10-21 02:32:15
  • Multiple Updates
2023-10-21 00:27:45
  • Multiple Updates
2023-10-20 17:27:45
  • Multiple Updates
2023-10-20 09:27:45
  • Multiple Updates
2023-10-20 02:33:20
  • Multiple Updates
2023-10-20 02:32:39
  • Multiple Updates
2023-10-19 21:27:48
  • Multiple Updates
2023-10-19 09:27:35
  • Multiple Updates
2023-10-19 00:27:38
  • Multiple Updates
2023-10-18 21:27:35
  • Multiple Updates
2023-10-17 09:27:31
  • Multiple Updates
2023-10-17 00:27:31
  • Multiple Updates
2023-10-16 02:31:06
  • Multiple Updates
2023-10-16 02:30:44
  • Multiple Updates
2023-10-16 00:27:26
  • Multiple Updates
2023-10-15 09:27:30
  • Multiple Updates
2023-10-14 09:27:29
  • Multiple Updates
2023-10-14 03:07:51
  • Multiple Updates
2023-10-14 03:07:29
  • Multiple Updates
2023-10-14 00:27:44
  • Multiple Updates
2023-10-13 21:27:32
  • Multiple Updates
2023-10-13 09:27:27
  • Multiple Updates
2023-10-13 00:27:24
  • Multiple Updates
2023-10-12 05:27:21
  • Multiple Updates
2023-10-12 02:32:08
  • Multiple Updates
2023-10-12 02:31:54
  • Multiple Updates
2023-10-12 00:27:22
  • Multiple Updates
2023-10-11 13:29:23
  • Multiple Updates
2023-10-11 13:29:08
  • Multiple Updates
2023-10-11 13:27:22
  • Multiple Updates
2023-10-11 09:27:20
  • Multiple Updates
2023-10-11 05:27:20
  • Multiple Updates
2023-10-11 00:27:22
  • Multiple Updates
2023-10-10 21:27:20
  • First insertion