# CVE-2023-44487 (HTTP/2 Rapid Reset) The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. - Page: https://www.vulneraibility.com/cve/CVE-2023-44487 - CVSS: 7.5 - Known exploited: yes, in CISA KEV since 2023-10-10; CISA due date 2023-10-31 - EPSS: 100.00% (percentile 100.0) - Public exploit code: 1 on Exploit-DB ยท 26 GitHub proofs of concept (first 2023-10-10) - CISA SSVC: exploitation active, automatable yes, technical impact partial (assessed 2024-07-23) - Weakness: CWE-400 - Also known as: GHSA-2m7v-gc89-fjqf, GHSA-qppj-fm5r-hxr3, GHSA-vx74-f528-fxqg, GHSA-xpw8-rcwv-8f8p, GO-2023-2102, GO-2023-2153 - Published: 2023-10-10 ## Affected versions - Apache Tomcat: affected >= 8.5.0 and < 8.5.94; >= 9.0.0 and < 9.0.81; >= 10.0.0 and < 10.1.14; fixed in 8.5.94, 9.0.81, 10.1.14 (Bitnami advisory, via OSV) - apisix: affected < 3.6.1; fixed in 3.6.1 (Bitnami advisory, via OSV) - ASP.NET Core: affected >= 6.0.0 and < 6.0.23; >= 7.0.0 and < 7.0.12; fixed in 6.0.23, 7.0.12 (Bitnami advisory, via OSV) - contour: affected < 1.24.6; fixed in 1.24.6 (Bitnami advisory, via OSV) - envoy: affected < 1.24.12; >= 1.25.0 and < 1.25.11; >= 1.26.0 and < 1.26.6; >= 1.27.0 and < 1.27.2; fixed in 1.24.12, 1.25.11, 1.26.6, 1.27.2 (Bitnami advisory, via OSV) - jenkins: affected < 2.414.3; >= 2.415.0 and < 2.428.0; fixed in 2.414.3, 2.428.0 (Bitnami advisory, via OSV) - kong: affected < 3.4.2; fixed in 3.4.2 (Bitnami advisory, via OSV) - .NET: affected >= 6.0.0 and < 6.0.23; >= 7.0.0 and < 7.0.12; fixed in 6.0.23, 7.0.12 (Bitnami advisory, via OSV) - .NET SDK: affected >= 6.0.0 and < 6.0.23; >= 7.0.0 and < 7.0.12; fixed in 6.0.23, 7.0.12 (Bitnami advisory, via OSV) - nginx: affected >= 1.9.5 and < 1.25.3; fixed in 1.25.3 (Bitnami advisory, via OSV) - nginx-gateway: affected >= 1.9.5 and < 1.25.3; fixed in 1.25.3 (Bitnami advisory, via OSV) - Node.js: affected >= 18.0.0 and < 18.18.2; >= 20.0.0 and < 20.8.1; fixed in 18.18.2, 20.8.1 (Node.js security advisory) - solr: affected < 9.4.0; fixed in 9.4.0 (Bitnami advisory, via OSV) - varnish: affected < 6.0.12; >= 6.1.0 and < 7.3.1; >= 7.4.0 and < 7.4.2; fixed in 6.0.12, 7.3.1, 7.4.2 (Bitnami advisory, via OSV) A version outside these ranges is not a statement that it is unaffected. ## References - [other] https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73 - [other] https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ - [other] https://aws.amazon.com/security/security-bulletins/AWS-2023-011/ - [other] https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack - [other] https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ - [other] https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/ - [other] https://news.ycombinator.com/item?id=37831062 - [other] https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/ - [other] https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack - [other] https://github.com/envoyproxy/envoy/pull/30055 - [other] https://github.com/haproxy/haproxy/issues/2312 - [other] https://github.com/eclipse/jetty.project/issues/10679 - [other] https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764 - [other] https://github.com/nghttp2/nghttp2/pull/1961 - [other] https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61 - [other] https://github.com/alibaba/tengine/issues/1872 - [other] https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2 - [other] https://news.ycombinator.com/item?id=37830987 - [other] https://news.ycombinator.com/item?id=37830998 - [other] https://github.com/caddyserver/caddy/issues/5877 - [other] https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/ - [other] https://github.com/bcdannyboy/CVE-2023-44487 - [other] https://github.com/grpc/grpc-go/pull/6703 - [other] https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244 - [other] https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0 - [other] https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html - [other] https://my.f5.com/manage/s/article/K000137106 - [other] https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/ - [other] https://bugzilla.proxmox.com/show_bug.cgi?id=4988 - [other] https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 - [other] http://www.openwall.com/lists/oss-security/2023/10/10/7 - [other] http://www.openwall.com/lists/oss-security/2023/10/10/6 - [other] https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected - [other] https://github.com/microsoft/CBL-Mariner/pull/6381 - [other] https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo - [other] https://github.com/facebook/proxygen/pull/466 - [other] https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088 - [other] https://github.com/micrictor/http2-rst-stream - [other] https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve - [other] https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/ - [other] https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf - [other] https://github.com/h2o/h2o/pull/3291 - [other] https://github.com/nodejs/node/pull/50121 - [other] https://github.com/dotnet/announcements/issues/277 - [other] https://github.com/golang/go/issues/63417 - [other] https://github.com/advisories/GHSA-vx74-f528-fxqg - [other] https://github.com/apache/trafficserver/pull/10564 - [other] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487 - [other] https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14 - [other] https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q --- Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.