Vulnerabilities in pkg:maven/org.eclipse.jetty.http2/jetty-http2-server

Q: What is CVE-2023-44487?

CVE-2023-44487 is a security vulnerability in Github.com/apple/swift nio http2 involving HTTP/2 Stream Cancellation Attack under CWE-400: Uncontrolled Resource Consumption.

Q: Which Github.com/apple/swift nio http2 versions are affected?

Affected versions include releases prior to 1.28.0, 0.17.0, 11.0.0-M12, 10.1.14, 9.0.81, 8.5.94, 9.4.53, 10.0.17, 11.0.17, 12.0.2, 10.5.3 across affected packages: github.com/apple/swift-nio-http2, golang.org/x/net, org.apache.tomcat:tomcat-coyote, org.apache.tomcat.embed:tomcat-embed-core, org.eclipse.jetty.http2:http2-common, org.eclipse.jetty.http2:http2-server, org.eclipse.jetty.http2:jetty-http2-common, org.eclipse.jetty.http2:jetty-http2-server, com.typesafe.akka:akka-http-core, com.typesafe.akka:akka-http-core_2.13, com.typesafe.akka:akka-http-core_2.12, com.typesafe.akka:akka-http-core_2.11.

Q: What version fixes CVE-2023-44487?

Upgrading to 1.28.0, 0.17.0, 11.0.0-M12, 10.1.14, 9.0.81, 8.5.94, 9.4.53, 10.0.17, 11.0.17, 12.0.2, 10.5.3 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is github.com/apple/swift-nio-http2 affected?

Yes, github.com/apple/swift-nio-http2 is affected in releases prior to 1.28.0. Upgrade your dependency to 1.28.0 or later.

Q: Is golang.org/x/net affected?

Yes, golang.org/x/net is affected in releases prior to 0.17.0. Upgrade your dependency to 0.17.0 or later.

Q: What is the CVSS score of CVE-2023-44487?

CVE-2023-44487 has a CVSS v3.1 base score of 5.3 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H.

Q: What CWE is associated with CVE-2023-44487?

CVE-2023-44487 is classified under CWE-400: Uncontrolled Resource Consumption (The product does not properly control the allocation and maintenance of a limited resource.).

Q: How can I check SwiftURL dependencies for CVE-2023-44487?

Run the dependency tree command: 'inspect dependencies for github.com/apple/swift-nio-http2'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

PACKAGE

Advisory Identifier: GHSA-qppj-fm5r-hxr3

Advisory Summary

CVE-2023-44487 is a MODERATE (CVSS 5.3) http/2 stream cancellation attack vulnerability (CWE-400: Uncontrolled Resource Consumption) affecting Github.com/apple/swift nio http2 libraries in the SwiftURL ecosystem. The issue involves http/2 stream cancellation attack. Remediation is available by upgrading affected packages to version 1.28.0, 0.17.0, 11.0.0-M12, 10.1.14, 9.0.81, 8.5.94, 9.4.53, 10.0.17, 11.0.17, 12.0.2, 10.5.3.

1 Known Advisory Record(s)

Package Vulnerability Intelligence

pkg:maven/org.eclipse.jetty.http2/jetty-http2-server

1 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:maven/org.eclipse.jetty.http2/jetty-http2-server. Select an advisory below to view technical details or fixes.

Advisory ID	CVE / NVD	Severity	Summary
GHSA-qppj-fm5r-hxr3	CVE-2023-44487	MODERATE	HTTP/2 Stream Cancellation Attack

CVE-2023-44487 at a Glance

CVE Identifier CVE-2023-44487

GHSA Identifier GHSA-qppj-fm5r-hxr3

Severity MODERATE

CVSS v3.1 Base Score 5.3

CWE Classification CWE-400: Uncontrolled Resource Consumption

Affected Product Github.com/apple/swift nio http2

Package Ecosystem SwiftURL

Published Date 2023-10-10

Last Updated 2026-05-13

Security Impact

CVSS: 5.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity None (I:N)

Availability Low (A:L)

How to Fix CVE-2023-44487

To remediate this vulnerability, upgrade all affected Github.com/apple/swift nio http2 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/apple/swift-nio-http2 fixed: 1.28.0

Upgrade github.com/apple/swift-nio-http2 to 1.28.0

golang.org/x/net fixed: 0.17.0

Upgrade golang.org/x/net to 0.17.0

org.apache.tomcat:tomcat-coyote fixed: 11.0.0-M12

<dependency>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>tomcat-coyote</artifactId>
    <version>11.0.0-M12</version>
</dependency>

org.apache.tomcat:tomcat-coyote fixed: 10.1.14

<dependency>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>tomcat-coyote</artifactId>
    <version>10.1.14</version>
</dependency>

org.apache.tomcat:tomcat-coyote fixed: 9.0.81

<dependency>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>tomcat-coyote</artifactId>
    <version>9.0.81</version>
</dependency>

org.apache.tomcat:tomcat-coyote fixed: 8.5.94

<dependency>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>tomcat-coyote</artifactId>
    <version>8.5.94</version>
</dependency>

org.apache.tomcat.embed:tomcat-embed-core fixed: 11.0.0-M12

<dependency>
    <groupId>org.apache.tomcat.embed</groupId>
    <artifactId>tomcat-embed-core</artifactId>
    <version>11.0.0-M12</version>
</dependency>

org.apache.tomcat.embed:tomcat-embed-core fixed: 10.1.14

<dependency>
    <groupId>org.apache.tomcat.embed</groupId>
    <artifactId>tomcat-embed-core</artifactId>
    <version>10.1.14</version>
</dependency>

org.apache.tomcat.embed:tomcat-embed-core fixed: 9.0.81

<dependency>
    <groupId>org.apache.tomcat.embed</groupId>
    <artifactId>tomcat-embed-core</artifactId>
    <version>9.0.81</version>
</dependency>

org.apache.tomcat.embed:tomcat-embed-core fixed: 8.5.94

<dependency>
    <groupId>org.apache.tomcat.embed</groupId>
    <artifactId>tomcat-embed-core</artifactId>
    <version>8.5.94</version>
</dependency>

org.eclipse.jetty.http2:http2-common fixed: 9.4.53

<dependency>
    <groupId>org.eclipse.jetty.http2</groupId>
    <artifactId>http2-common</artifactId>
    <version>9.4.53</version>
</dependency>

org.eclipse.jetty.http2:http2-common fixed: 10.0.17

<dependency>
    <groupId>org.eclipse.jetty.http2</groupId>
    <artifactId>http2-common</artifactId>
    <version>10.0.17</version>
</dependency>

org.eclipse.jetty.http2:http2-common fixed: 11.0.17

<dependency>
    <groupId>org.eclipse.jetty.http2</groupId>
    <artifactId>http2-common</artifactId>
    <version>11.0.17</version>
</dependency>

org.eclipse.jetty.http2:http2-server fixed: 9.4.53

<dependency>
    <groupId>org.eclipse.jetty.http2</groupId>
    <artifactId>http2-server</artifactId>
    <version>9.4.53</version>
</dependency>

org.eclipse.jetty.http2:http2-server fixed: 10.0.17

<dependency>
    <groupId>org.eclipse.jetty.http2</groupId>
    <artifactId>http2-server</artifactId>
    <version>10.0.17</version>
</dependency>

org.eclipse.jetty.http2:http2-server fixed: 11.0.17

<dependency>
    <groupId>org.eclipse.jetty.http2</groupId>
    <artifactId>http2-server</artifactId>
    <version>11.0.17</version>
</dependency>

org.eclipse.jetty.http2:jetty-http2-common fixed: 12.0.2

<dependency>
    <groupId>org.eclipse.jetty.http2</groupId>
    <artifactId>jetty-http2-common</artifactId>
    <version>12.0.2</version>
</dependency>

org.eclipse.jetty.http2:jetty-http2-server fixed: 12.0.2

<dependency>
    <groupId>org.eclipse.jetty.http2</groupId>
    <artifactId>jetty-http2-server</artifactId>
    <version>12.0.2</version>
</dependency>

com.typesafe.akka:akka-http-core fixed: 10.5.3

<dependency>
    <groupId>com.typesafe.akka</groupId>
    <artifactId>akka-http-core</artifactId>
    <version>10.5.3</version>
</dependency>

com.typesafe.akka:akka-http-core_2.13 fixed: 10.5.3

<dependency>
    <groupId>com.typesafe.akka</groupId>
    <artifactId>akka-http-core_2.13</artifactId>
    <version>10.5.3</version>
</dependency>

com.typesafe.akka:akka-http-core_2.12 fixed: 10.5.3

<dependency>
    <groupId>com.typesafe.akka</groupId>
    <artifactId>akka-http-core_2.12</artifactId>
    <version>10.5.3</version>
</dependency>

com.typesafe.akka:akka-http-core_2.11 fixed: Latest secure release

<dependency>
    <groupId>com.typesafe.akka</groupId>
    <artifactId>akka-http-core_2.11</artifactId>
    <version>Latest secure release</version>
</dependency>

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for github.com/apple/swift-nio-http2

How to Check if You Are Affected

To determine whether your application is affected by CVE-2023-44487, inspect your project dependencies for Github.com/apple/swift nio http2:

inspect dependencies for github.com/apple/swift-nio-http2

Analyze the terminal output to locate any version of Github.com/apple/swift nio http2 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.28.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-400: Uncontrolled Resource Consumption, where the product does not properly control the allocation and maintenance of a limited resource. In Github.com/apple/swift nio http2, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

## HTTP/2 Rapid reset attack The HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed. Abuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. The HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately. The ability to reset streams immediately allows each connection to have an indefinite number of requests in flight. By explicitly canceling the requests, the attacker never exceeds the limit on the number of concurrent open streams. The number of in-flight requests is no longer dependent on the round-trip time (RTT), but only on the available network bandwidth. In a typical HTTP/2 server implementation, the server will still have to do significant amounts of work for canceled requests, such as allocating new stream data structures, parsing the query and doing header decompression, and mapping the URL to a resource. For reverse proxy implementations, the request may be proxied to the backend server before the RST_STREAM frame is processed. The client on the other hand paid almost no costs for sending the requests. This creates an exploitable cost asymmetry between the server and the client. Multiple software artifacts implementing HTTP/2 are affected. This advisory was originally ingested from the `swift-nio-http2` repo advisory and their original conent follows. ## swift-nio-http2 specific advisory swift-nio-http2 is vulnerable to a denial-of-service vulnerability in which a malicious client can create and then reset a large number of HTTP/2 streams in a short period of time. This causes swift-nio-http2 to commit to a large amount of expensive work which it then throws away, including creating entirely new `Channel`s to serve the traffic. This can easily overwhelm an `EventLoop` and prevent it from making forward progress. swift-nio-http2 1.28 contains a remediation for this issue that applies reset counter using a sliding window. This constrains the number of stream resets that may occur in a given window of time. Clients violating this limit will have their connections torn down. This allows clients to continue to cancel streams for legitimate reasons, while constraining malicious actors.

CVE-2023-44487 Affected Github.com/apple/swift nio http2 Versions

22 component(s)

Fixed Versions:

1.28.00.17.011.0.0-M1210.1.149.0.818.5.949.4.5310.0.1711.0.1712.0.210.5.3

Product / Package	Ecosystem	Affected Versions	Fixed Version
github.com/apple/swift-nio-http2	SwiftURL	< 1.28.0	1.28.0
golang.org/x/net golang/golang.org/x/net	Go	< 0.17.0	0.17.0
org.apache.tomcat:tomcat-coyote maven/org.apache.tomcat/tomcat-coyote	Maven	≥ 11.0.0-M1 < 11.0.0-M12	11.0.0-M12
org.apache.tomcat:tomcat-coyote maven/org.apache.tomcat/tomcat-coyote	Maven	≥ 10.0.0 < 10.1.14	10.1.14
org.apache.tomcat:tomcat-coyote maven/org.apache.tomcat/tomcat-coyote	Maven	≥ 9.0.0 < 9.0.81	9.0.81
org.apache.tomcat:tomcat-coyote maven/org.apache.tomcat/tomcat-coyote	Maven	≥ 8.5.0 < 8.5.94	8.5.94
org.apache.tomcat.embed:tomcat-embed-core maven/org.apache.tomcat.embed/tomcat-embed-core	Maven	≥ 11.0.0-M1 < 11.0.0-M12	11.0.0-M12
org.apache.tomcat.embed:tomcat-embed-core maven/org.apache.tomcat.embed/tomcat-embed-core	Maven	≥ 10.0.0 < 10.1.14	10.1.14
org.apache.tomcat.embed:tomcat-embed-core maven/org.apache.tomcat.embed/tomcat-embed-core	Maven	≥ 9.0.0 < 9.0.81	9.0.81
org.apache.tomcat.embed:tomcat-embed-core maven/org.apache.tomcat.embed/tomcat-embed-core	Maven	≥ 8.5.0 < 8.5.94	8.5.94
org.eclipse.jetty.http2:http2-common maven/org.eclipse.jetty.http2/http2-common	Maven	≥ 9.3.0 < 9.4.53	9.4.53
org.eclipse.jetty.http2:http2-common maven/org.eclipse.jetty.http2/http2-common	Maven	≥ 10.0.0 < 10.0.17	10.0.17
org.eclipse.jetty.http2:http2-common maven/org.eclipse.jetty.http2/http2-common	Maven	≥ 11.0.0 < 11.0.17	11.0.17
org.eclipse.jetty.http2:http2-server maven/org.eclipse.jetty.http2/http2-server	Maven	≥ 9.3.0 < 9.4.53	9.4.53
org.eclipse.jetty.http2:http2-server maven/org.eclipse.jetty.http2/http2-server	Maven	≥ 10.0.0 < 10.0.17	10.0.17
org.eclipse.jetty.http2:http2-server maven/org.eclipse.jetty.http2/http2-server	Maven	≥ 11.0.0 < 11.0.17	11.0.17
org.eclipse.jetty.http2:jetty-http2-common maven/org.eclipse.jetty.http2/jetty-http2-common	Maven	≥ 12.0.0 < 12.0.2	12.0.2
org.eclipse.jetty.http2:jetty-http2-server maven/org.eclipse.jetty.http2/jetty-http2-server	Maven	≥ 12.0.0 < 12.0.2	12.0.2
com.typesafe.akka:akka-http-core maven/com.typesafe.akka/akka-http-core	Maven	< 10.5.3	10.5.3
com.typesafe.akka:akka-http-core_2.13 maven/com.typesafe.akka/akka-http-core_2.13	Maven	< 10.5.3	10.5.3
com.typesafe.akka:akka-http-core_2.12 maven/com.typesafe.akka/akka-http-core_2.12	Maven	< 10.5.3	10.5.3
com.typesafe.akka:akka-http-core_2.11 maven/com.typesafe.akka/akka-http-core_2.11	Maven	≤ 10.1.15

References

GitHub Advisory / Wiki ADVISORY

https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3

GitHub Advisory / Wiki ADVISORY

https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf

NVD — CVE-2023-44487 NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-44487

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/alibaba/tengine/issues/1872

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/apache/apisix/issues/10320

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/akka/akka-http/issues/4323

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/varnishcache/varnish-cache/issues/3996

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/tempesta-tech/tempesta/issues/1986

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/Azure/AKS/issues/3947

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/opensearch-project/data-prepper/issues/3474

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/caddyserver/caddy/issues/5877

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/openresty/openresty/issues/930

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/dotnet/announcements/issues/277

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/eclipse/jetty.project/issues/10679

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/etcd-io/etcd/issues/16740

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/golang/go/issues/63417

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/ninenines/cowboy/issues/1615

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/haproxy/haproxy/issues/2312

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/hyperium/hyper/issues/3337

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/kazu-yamamoto/http2/issues/93

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/junkurihara/rust-rpxy/issues/97

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/microsoft/CBL-Mariner/pull/6381

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/line/armeria/pull/5232

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/kubernetes/kubernetes/pull/121120

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/apache/httpd-site/pull/10

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/projectcontour/contour/pull/5826

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/apache/trafficserver/pull/10564

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/nghttp2/nghttp2/pull/1961

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/h2o/h2o/pull/3291

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/grpc/grpc-go/pull/6703

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/nodejs/node/pull/50121

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/envoyproxy/envoy/pull/30055

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/facebook/proxygen/pull/466

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/akka/akka-http/pull/4325

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/akka/akka-http/pull/4324

Security Fix Commit FIX COMMIT

https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61

Security Fix Commit FIX COMMIT

https://github.com/apache/tomcat/commit/944332bb15bd2f3bf76ec2caeb1ff0a58a3bc628

Security Fix Commit FIX COMMIT

https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1

lists.w3.org/archives/public/iet... WEB

https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5

martinthomson.github.io/h2-stream-limits/dr... WEB

https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y

mailman.nginx.org/pipermail/nginx-dev... WEB

https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ

Github.com/apple/swift nio http2 Security Information SECURITY

https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81

Github.com/apple/swift nio http2 Security Information SECURITY

https://ubuntu.com/security/CVE-2023-44487

Github.com/apple/swift nio http2 Security Information SECURITY

https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records

www.cisa.gov/known-exploited-vul... WEB

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487

www.cisa.gov/news-events/alerts/... WEB

https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487

www.darkreading.com/cloud/internet-wide... WEB

https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event

Github.com/apple/swift nio http2 Security Information SECURITY

https://www.debian.org/security/2023/dsa-5521

Github.com/apple/swift nio http2 Security Information SECURITY

https://www.debian.org/security/2023/dsa-5522

Github.com/apple/swift nio http2 Security Information SECURITY

https://www.debian.org/security/2023/dsa-5540

Github.com/apple/swift nio http2 Security Information SECURITY

https://www.debian.org/security/2023/dsa-5549

Github.com/apple/swift nio http2 Security Information SECURITY

https://www.debian.org/security/2023/dsa-5558

Github.com/apple/swift nio http2 Security Information SECURITY

https://www.debian.org/security/2023/dsa-5570

www.eclipse.org/lists/jetty-announc... WEB

https://www.eclipse.org/lists/jetty-announce/msg00181.html

www.haproxy.com/blog/haproxy-is-not... WEB

https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487

www.netlify.com/blog/netlify-succes... WEB

https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487

www.nginx.com/blog/http-2-rapid-r... WEB

https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products

Github.com/apple/swift nio http2 Security Information SECURITY

https://www.openwall.com/lists/oss-security/2023/10/10/6

www.phoronix.com/news/http2-rapid-re... WEB

https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack

www.theregister.com/2023/10/10/http2_ra... WEB

https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday

www.vicarius.io/vsociety/posts/rapi... WEB

https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause

msrc.microsoft.com/blog/2023/10/micros... WEB

https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2

msrc.microsoft.com/update-guide/vulner... WEB

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487

my.f5.com/manage/s/article/k0... WEB

https://my.f5.com/manage/s/article/K000137106

netty.io/news/2023/10/10/4-1... WEB

https://netty.io/news/2023/10/10/4-1-100-Final.html

news.ycombinator.com/item WEB

https://news.ycombinator.com/item?id=37830987

news.ycombinator.com/item WEB

https://news.ycombinator.com/item?id=37830998

news.ycombinator.com/item WEB

https://news.ycombinator.com/item?id=37831062

news.ycombinator.com/item WEB

https://news.ycombinator.com/item?id=37837043

openssf.org/blog/2023/10/10/htt... WEB

https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response

seanmonstar.com/post/73079415113693... WEB

https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected

Github.com/apple/swift nio http2 Security Information SECURITY

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ

Github.com/apple/swift nio http2 Security Information SECURITY

https://security.gentoo.org/glsa/202311-09

Github.com/apple/swift nio http2 Security Information SECURITY

https://security.netapp.com/advisory/ntap-20231016-0001

Github.com/apple/swift nio http2 Security Information SECURITY

https://security.netapp.com/advisory/ntap-20240426-0007

Github.com/apple/swift nio http2 Security Information SECURITY

https://security.netapp.com/advisory/ntap-20240621-0006

Github.com/apple/swift nio http2 Security Information SECURITY

https://security.netapp.com/advisory/ntap-20240621-0007

Github.com/apple/swift nio http2 Security Information SECURITY

https://security.paloaltonetworks.com/CVE-2023-44487

Github.com/apple/swift nio http2 Security Information SECURITY

https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14

Github.com/apple/swift nio http2 Security Information SECURITY

https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12

Github.com/apple/swift nio http2 Security Information SECURITY

https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94

chaos.social/@icing/111210915918... WEB

https://chaos.social/@icing/111210915918780532

Github.com/apple/swift nio http2 Security Information SECURITY

https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps

Github.com/apple/swift nio http2 Security Information SECURITY

https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack

community.traefik.io/t/is-traefik-vulner... WEB

https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125

discuss.hashicorp.com/t/hcsec-2023-32-vau... WEB

https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715

edg.io/lp/blog/resets-leak... WEB

https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve

Github.com/apple/swift nio http2 Security Information SECURITY

https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/Kong/kong/discussions/11741

GitHub Advisory / Wiki ADVISORY

https://github.com/advisories/GHSA-qppj-fm5r-hxr3

GitHub Advisory / Wiki ADVISORY

https://github.com/advisories/GHSA-vx74-f528-fxqg

GitHub Advisory / Wiki ADVISORY

https://github.com/advisories/GHSA-xpw8-rcwv-8f8p

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/apple/swift-nio-http2

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/bcdannyboy/CVE-2023-44487

Github.com/apple/swift nio http2 Release RELEASE

https://github.com/caddyserver/caddy/releases/tag/v2.7.5

Github.com/apple/swift nio http2 Security Information SECURITY

https://access.redhat.com/security/cve/cve-2023-44487

Github.com/apple/swift nio http2 Security Information SECURITY

https://akka.io/security/akka-http-cve-2023-44487.html

Github.com/apple/swift nio http2 Security Information SECURITY

https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size

Github.com/apple/swift nio http2 Security Information SECURITY

https://aws.amazon.com/security/security-bulletins/AWS-2023-011

blog.cloudflare.com/technical-breakdown... WEB

https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack

blog.cloudflare.com/zero-day-rapid-rese... WEB

https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack

blog.litespeedtech.com/2023/10/11/rapid-re... WEB

https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty

blog.qualys.com/vulnerabilities-thr... WEB

https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack

blog.vespa.ai/cve-2023-44487 WEB

https://blog.vespa.ai/cve-2023-44487

bugzilla.proxmox.com/show_bug.cgi WEB

https://bugzilla.proxmox.com/show_bug.cgi?id=4988

bugzilla.redhat.com/show_bug.cgi WEB

https://bugzilla.redhat.com/show_bug.cgi?id=2242803

bugzilla.suse.com/show_bug.cgi WEB

https://bugzilla.suse.com/show_bug.cgi?id=1216123

cert-portal.siemens.com/productcert/html/ss... WEB

https://cert-portal.siemens.com/productcert/html/ssa-082556.html

cert-portal.siemens.com/productcert/html/ss... WEB

https://cert-portal.siemens.com/productcert/html/ssa-341067.html

cert-portal.siemens.com/productcert/html/ss... WEB

https://cert-portal.siemens.com/productcert/html/ssa-784301.html

cert-portal.siemens.com/productcert/html/ss... WEB

https://cert-portal.siemens.com/productcert/html/ssa-832273.html

cert-portal.siemens.com/productcert/html/ss... WEB

https://cert-portal.siemens.com/productcert/html/ssa-915275.html

cgit.freebsd.org/ports/commit/ WEB

https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9

lists.debian.org/debian-lts-announce... WEB

https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html

lists.debian.org/debian-lts-announce... WEB

https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html

lists.debian.org/debian-lts-announce... WEB

https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html

lists.debian.org/debian-lts-announce... WEB

https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/grpc/grpc-go/releases

Github.com/apple/swift nio http2 Release RELEASE

https://github.com/grpc/grpc/releases/tag/v1.59.2

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/micrictor/http2-rst-stream

Github.com/apple/swift nio http2 Release RELEASE

https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0

Github.com/apple/swift nio http2 Source Repository REPOSITORY

https://github.com/oqtane/oqtane.framework/discussions/3367

go.dev/cl/534215 WEB

https://go.dev/cl/534215

go.dev/cl/534235 WEB

https://go.dev/cl/534235

go.dev/issue/63417 WEB

https://go.dev/issue/63417

groups.google.com/g/golang-announce/c... WEB

https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo

groups.google.com/g/golang-announce/c... WEB

https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ

Github.com/apple/swift nio http2 Security Information SECURITY

https://istio.io/latest/news/security/istio-security-2023-004

linkerd.io/2023/10/12/linkerd-... WEB

https://linkerd.io/2023/10/12/linkerd-cve-2023-44487

lists.apache.org/thread/5py8h42mxfsn... WEB

https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q

lists.debian.org/debian-lts-announce... WEB

https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html

lists.debian.org/debian-lts-announce... WEB

https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html

lists.debian.org/debian-lts-announce... WEB

https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html

Github.com/apple/swift nio http2 Security Information SECURITY

http://www.openwall.com/lists/oss-security/2023/10/10/6

Github.com/apple/swift nio http2 Security Information SECURITY

http://www.openwall.com/lists/oss-security/2023/10/10/7

Github.com/apple/swift nio http2 Security Information SECURITY

http://www.openwall.com/lists/oss-security/2023/10/13/4

Github.com/apple/swift nio http2 Security Information SECURITY

http://www.openwall.com/lists/oss-security/2023/10/13/9

Github.com/apple/swift nio http2 Security Information SECURITY

http://www.openwall.com/lists/oss-security/2023/10/18/4

Github.com/apple/swift nio http2 Security Information SECURITY

http://www.openwall.com/lists/oss-security/2023/10/18/8

Github.com/apple/swift nio http2 Security Information SECURITY

http://www.openwall.com/lists/oss-security/2023/10/19/6

Github.com/apple/swift nio http2 Security Information SECURITY

http://www.openwall.com/lists/oss-security/2023/10/20/8

Github.com/apple/swift nio http2 Security Information SECURITY

http://www.openwall.com/lists/oss-security/2025/08/13/6

Frequently Asked Questions

What is CVE-2023-44487?

CVE-2023-44487 is a security vulnerability in Github.com/apple/swift nio http2 involving HTTP/2 Stream Cancellation Attack under CWE-400: Uncontrolled Resource Consumption.

Which Github.com/apple/swift nio http2 versions are affected?

Affected versions include releases prior to 1.28.0, 0.17.0, 11.0.0-M12, 10.1.14, 9.0.81, 8.5.94, 9.4.53, 10.0.17, 11.0.17, 12.0.2, 10.5.3 across affected packages: github.com/apple/swift-nio-http2, golang.org/x/net, org.apache.tomcat:tomcat-coyote, org.apache.tomcat.embed:tomcat-embed-core, org.eclipse.jetty.http2:http2-common, org.eclipse.jetty.http2:http2-server, org.eclipse.jetty.http2:jetty-http2-common, org.eclipse.jetty.http2:jetty-http2-server, com.typesafe.akka:akka-http-core, com.typesafe.akka:akka-http-core_2.13, com.typesafe.akka:akka-http-core_2.12, com.typesafe.akka:akka-http-core_2.11.

What version fixes CVE-2023-44487?

Upgrading to 1.28.0, 0.17.0, 11.0.0-M12, 10.1.14, 9.0.81, 8.5.94, 9.4.53, 10.0.17, 11.0.17, 12.0.2, 10.5.3 (or the latest patched release for your respective branch) resolves the vulnerability.

Is github.com/apple/swift-nio-http2 affected?

Yes, github.com/apple/swift-nio-http2 is affected in releases prior to 1.28.0. Upgrade your dependency to 1.28.0 or later.

Is golang.org/x/net affected?

Yes, golang.org/x/net is affected in releases prior to 0.17.0. Upgrade your dependency to 0.17.0 or later.

What is the CVSS score of CVE-2023-44487?

CVE-2023-44487 has a CVSS v3.1 base score of 5.3 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H.

What CWE is associated with CVE-2023-44487?

CVE-2023-44487 is classified under CWE-400: Uncontrolled Resource Consumption (The product does not properly control the allocation and maintenance of a limited resource.).

How can I check SwiftURL dependencies for CVE-2023-44487?

Run the dependency tree command: 'inspect dependencies for github.com/apple/swift-nio-http2'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qppj-fm5r-hxr3",
  "modified" : "2026-05-13T15:25:08Z",
  "published" : "2023-10-10T21:28:24Z",
  "aliases" : [ "CVE-2023-44487" ],
  "summary" : "HTTP/2 Stream Cancellation Attack",
  "details" : "## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight. By explicitly canceling the requests, the attacker never exceeds the limit on the number of concurrent open streams. The number of in-flight requests is no longer dependent on the round-trip time (RTT), but only on the available network bandwidth.\n\nIn a typical HTTP/2 server implementation, the server will still have to do significant amounts of work for canceled requests, such as allocating new stream data structures, parsing the query and doing header decompression, and mapping the URL to a resource. For reverse proxy implementations, the request may be proxied to the backend server before the RST_STREAM frame is processed. The client on the other hand paid almost no costs for sending the requests. This creates an exploitable cost asymmetry between the server and the client.\n\nMultiple software artifacts implementing HTTP/2 are affected. This advisory was originally ingested from the `swift-nio-http2` repo advisory and their original conent follows.\n\n## swift-nio-http2 specific advisory\nswift-nio-http2 is vulnerable to a denial-of-service vulnerability in which a malicious client can create and then reset a large number of HTTP/2 streams in a short period of time. This causes swift-nio-http2 to commit to a large amount of expensive work which it then throws away, including creating entirely new `Channel`s to serve the traffic. This can easily overwhelm an `EventLoop` and prevent it from making forward progress.\n\nswift-nio-http2 1.28 contains a remediation for this issue that applies reset counter using a sliding window. This constrains the number of stream resets that may occur in a given window of time. Clients violating this limit will have their connections torn down. This allows clients to continue to cancel streams for legitimate reasons, while constraining malicious actors.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:A"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "SwiftURL",
      "name" : "github.com/apple/swift-nio-http2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.28.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "golang.org/x/net"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.17.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat:tomcat-coyote"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "11.0.0-M1"
      }, {
        "fixed" : "11.0.0-M12"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat:tomcat-coyote"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "10.0.0"
      }, {
        "fixed" : "10.1.14"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat:tomcat-coyote"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "9.0.0"
      }, {
        "fixed" : "9.0.81"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat:tomcat-coyote"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "8.5.0"
      }, {
        "fixed" : "8.5.94"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat.embed:tomcat-embed-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "11.0.0-M1"
      }, {
        "fixed" : "11.0.0-M12"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat.embed:tomcat-embed-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "10.0.0"
      }, {
        "fixed" : "10.1.14"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat.embed:tomcat-embed-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "9.0.0"
      }, {
        "fixed" : "9.0.81"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat.embed:tomcat-embed-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "8.5.0"
      }, {
        "fixed" : "8.5.94"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.eclipse.jetty.http2:http2-common"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "9.3.0"
      }, {
        "fixed" : "9.4.53"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.eclipse.jetty.http2:http2-common"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "10.0.0"
      }, {
        "fixed" : "10.0.17"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.eclipse.jetty.http2:http2-common"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "11.0.0"
      }, {
        "fixed" : "11.0.17"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.eclipse.jetty.http2:http2-server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "9.3.0"
      }, {
        "fixed" : "9.4.53"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.eclipse.jetty.http2:http2-server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "10.0.0"
      }, {
        "fixed" : "10.0.17"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.eclipse.jetty.http2:http2-server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "11.0.0"
      }, {
        "fixed" : "11.0.17"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.eclipse.jetty.http2:jetty-http2-common"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "12.0.0"
      }, {
        "fixed" : "12.0.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.eclipse.jetty.http2:jetty-http2-server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "12.0.0"
      }, {
        "fixed" : "12.0.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "com.typesafe.akka:akka-http-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "10.5.3"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "com.typesafe.akka:akka-http-core_2.13"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "10.5.3"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "com.typesafe.akka:akka-http-core_2.12"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "10.5.3"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "com.typesafe.akka:akka-http-core_2.11"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "10.1.15"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-44487"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/alibaba/tengine/issues/1872"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/apisix/issues/10320"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/akka/akka-http/issues/4323"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/varnishcache/varnish-cache/issues/3996"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/tempesta-tech/tempesta/issues/1986"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Azure/AKS/issues/3947"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/opensearch-project/data-prepper/issues/3474"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/caddyserver/caddy/issues/5877"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openresty/openresty/issues/930"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/dotnet/announcements/issues/277"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/eclipse/jetty.project/issues/10679"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/etcd-io/etcd/issues/16740"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/golang/go/issues/63417"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ninenines/cowboy/issues/1615"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/haproxy/haproxy/issues/2312"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/hyperium/hyper/issues/3337"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/kazu-yamamoto/http2/issues/93"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/junkurihara/rust-rpxy/issues/97"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/microsoft/CBL-Mariner/pull/6381"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/line/armeria/pull/5232"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/kubernetes/kubernetes/pull/121120"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/httpd-site/pull/10"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/projectcontour/contour/pull/5826"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/trafficserver/pull/10564"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nghttp2/nghttp2/pull/1961"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/h2o/h2o/pull/3291"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/grpc/grpc-go/pull/6703"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nodejs/node/pull/50121"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/envoyproxy/envoy/pull/30055"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/facebook/proxygen/pull/466"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/akka/akka-http/pull/4325"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/akka/akka-http/pull/4324"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/944332bb15bd2f3bf76ec2caeb1ff0a58a3bc628"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1"
  }, {
    "type" : "WEB",
    "url" : "https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5"
  }, {
    "type" : "WEB",
    "url" : "https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y"
  }, {
    "type" : "WEB",
    "url" : "https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ"
  }, {
    "type" : "WEB",
    "url" : "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81"
  }, {
    "type" : "WEB",
    "url" : "https://ubuntu.com/security/CVE-2023-44487"
  }, {
    "type" : "WEB",
    "url" : "https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records"
  }, {
    "type" : "WEB",
    "url" : "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487"
  }, {
    "type" : "WEB",
    "url" : "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487"
  }, {
    "type" : "WEB",
    "url" : "https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2023/dsa-5521"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2023/dsa-5522"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2023/dsa-5540"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2023/dsa-5549"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2023/dsa-5558"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2023/dsa-5570"
  }, {
    "type" : "WEB",
    "url" : "https://www.eclipse.org/lists/jetty-announce/msg00181.html"
  }, {
    "type" : "WEB",
    "url" : "https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487"
  }, {
    "type" : "WEB",
    "url" : "https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487"
  }, {
    "type" : "WEB",
    "url" : "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products"
  }, {
    "type" : "WEB",
    "url" : "https://www.openwall.com/lists/oss-security/2023/10/10/6"
  }, {
    "type" : "WEB",
    "url" : "https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack"
  }, {
    "type" : "WEB",
    "url" : "https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday"
  }, {
    "type" : "WEB",
    "url" : "https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause"
  }, {
    "type" : "WEB",
    "url" : "https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2"
  }, {
    "type" : "WEB",
    "url" : "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487"
  }, {
    "type" : "WEB",
    "url" : "https://my.f5.com/manage/s/article/K000137106"
  }, {
    "type" : "WEB",
    "url" : "https://netty.io/news/2023/10/10/4-1-100-Final.html"
  }, {
    "type" : "WEB",
    "url" : "https://news.ycombinator.com/item?id=37830987"
  }, {
    "type" : "WEB",
    "url" : "https://news.ycombinator.com/item?id=37830998"
  }, {
    "type" : "WEB",
    "url" : "https://news.ycombinator.com/item?id=37831062"
  }, {
    "type" : "WEB",
    "url" : "https://news.ycombinator.com/item?id=37837043"
  }, {
    "type" : "WEB",
    "url" : "https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response"
  }, {
    "type" : "WEB",
    "url" : "https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected"
  }, {
    "type" : "WEB",
    "url" : "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ"
  }, {
    "type" : "WEB",
    "url" : "https://security.gentoo.org/glsa/202311-09"
  }, {
    "type" : "WEB",
    "url" : "https://security.netapp.com/advisory/ntap-20231016-0001"
  }, {
    "type" : "WEB",
    "url" : "https://security.netapp.com/advisory/ntap-20240426-0007"
  }, {
    "type" : "WEB",
    "url" : "https://security.netapp.com/advisory/ntap-20240621-0006"
  }, {
    "type" : "WEB",
    "url" : "https://security.netapp.com/advisory/ntap-20240621-0007"
  }, {
    "type" : "WEB",
    "url" : "https://security.paloaltonetworks.com/CVE-2023-44487"
  }, {
    "type" : "WEB",
    "url" : "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14"
  }, {
    "type" : "WEB",
    "url" : "https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12"
  }, {
    "type" : "WEB",
    "url" : "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94"
  }, {
    "type" : "WEB",
    "url" : "https://chaos.social/@icing/111210915918780532"
  }, {
    "type" : "WEB",
    "url" : "https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps"
  }, {
    "type" : "WEB",
    "url" : "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack"
  }, {
    "type" : "WEB",
    "url" : "https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125"
  }, {
    "type" : "WEB",
    "url" : "https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715"
  }, {
    "type" : "WEB",
    "url" : "https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve"
  }, {
    "type" : "WEB",
    "url" : "https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764"
  }, {
    "type" : "WEB",
    "url" : "https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Kong/kong/discussions/11741"
  }, {
    "type" : "ADVISORY",
    "url" : "https://github.com/advisories/GHSA-qppj-fm5r-hxr3"
  }, {
    "type" : "ADVISORY",
    "url" : "https://github.com/advisories/GHSA-vx74-f528-fxqg"
  }, {
    "type" : "ADVISORY",
    "url" : "https://github.com/advisories/GHSA-xpw8-rcwv-8f8p"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/apple/swift-nio-http2"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/bcdannyboy/CVE-2023-44487"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/caddyserver/caddy/releases/tag/v2.7.5"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/cve-2023-44487"
  }, {
    "type" : "WEB",
    "url" : "https://akka.io/security/akka-http-cve-2023-44487.html"
  }, {
    "type" : "WEB",
    "url" : "https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size"
  }, {
    "type" : "WEB",
    "url" : "https://aws.amazon.com/security/security-bulletins/AWS-2023-011"
  }, {
    "type" : "WEB",
    "url" : "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack"
  }, {
    "type" : "WEB",
    "url" : "https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack"
  }, {
    "type" : "WEB",
    "url" : "https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty"
  }, {
    "type" : "WEB",
    "url" : "https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack"
  }, {
    "type" : "WEB",
    "url" : "https://blog.vespa.ai/cve-2023-44487"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.proxmox.com/show_bug.cgi?id=4988"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2242803"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.suse.com/show_bug.cgi?id=1216123"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-341067.html"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-784301.html"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-832273.html"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-915275.html"
  }, {
    "type" : "WEB",
    "url" : "https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/grpc/grpc-go/releases"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/grpc/grpc/releases/tag/v1.59.2"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/micrictor/http2-rst-stream"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/oqtane/oqtane.framework/discussions/3367"
  }, {
    "type" : "WEB",
    "url" : "https://go.dev/cl/534215"
  }, {
    "type" : "WEB",
    "url" : "https://go.dev/cl/534235"
  }, {
    "type" : "WEB",
    "url" : "https://go.dev/issue/63417"
  }, {
    "type" : "WEB",
    "url" : "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo"
  }, {
    "type" : "WEB",
    "url" : "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ"
  }, {
    "type" : "WEB",
    "url" : "https://istio.io/latest/news/security/istio-security-2023-004"
  }, {
    "type" : "WEB",
    "url" : "https://linkerd.io/2023/10/12/linkerd-cve-2023-44487"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/10/10/6"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/10/10/7"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/10/13/4"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/10/13/9"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/10/18/4"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/10/18/8"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/10/19/6"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2023/10/20/8"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2025/08/13/6"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-10-10T21:28:24Z",
    "nvd_published_at" : "2023-10-10T14:15:10Z"
  }
}

CVSS V3

5.3 MODERATE

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity None (I:N)

Availability Low (A:L)

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H

Advisory Metadata

Source ID: GHSA-qppj-fm5r-hxr3
Schema Version: 1.4.0
Published: 2023-10-10 21:28
Last Modified: 2026-05-13 15:25
Database Record File: advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json