CVE-2023-44487
KEV High · CVSS 7.5- CVSS
- 7.5
- nvd
- EPSS
- —
- KEV
- Listed
- 2023-10-10
- Class
- oss containerizable
- NVD-CWE-noinfo, CWE-400
Description
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Affected packages
| Bitnami | apisix | 0 → 3.6.1 |
| Bitnami | aspnet-core | 6.0.0 → 6.0.23 |
| Bitnami | aspnet-core | 7.0.0 → 7.0.12 |
| Bitnami | contour | 0 → 1.24.6 |
| Bitnami | dotnet | 6.0.0 → 6.0.23 |
| Bitnami | dotnet | 7.0.0 → 7.0.12 |
| Bitnami | dotnet-sdk | 6.0.0 → 6.0.23 |
| Bitnami | dotnet-sdk | 7.0.0 → 7.0.12 |
| Bitnami | envoy | 0 → 1.24.12 |
| Bitnami | envoy | 1.25.0 → 1.25.11 |
| Bitnami | envoy | 1.26.0 → 1.26.6 |
| Bitnami | envoy | 1.27.0 → 1.27.2 |
| Bitnami | golang | 0 → 1.20.10 |
| Bitnami | golang | 1.21.0-0 → 1.21.3 |
| Bitnami | jenkins | 0 → 2.414.3 |
| Bitnami | jenkins | 2.415.0 → 2.428.0 |
| Bitnami | kong | 0 → 3.4.2 |
| Bitnami | nginx | 1.9.5 → 1.25.3 |
| Bitnami | nginx-gateway | 1.9.5 → 1.25.3 |
| Bitnami | node | 0 → 18.18.2 |
| Bitnami | node | 19.0.0 → 20.8.1 |
| Bitnami | node-min | 0 → 18.18.2 |
| Bitnami | node-min | 19.0.0 → 20.8.1 |
| Bitnami | solr | 0 → 9.4.0 |
| Bitnami | tomcat | 10.0.0 → 10.1.14 |
| Bitnami | tomcat | 8.5.0 → 8.5.94 |
| Bitnami | tomcat | 9.0.0 → 9.0.81 |
| Bitnami | varnish | 0 → 6.0.12 |
| Bitnami | varnish | 6.1.0 → 7.3.1 |
| Bitnami | varnish | 7.4.0 → 7.4.2 |
| Go | golang.org/x/net | 0 → 0.17.0 |
| Maven | com.typesafe.akka:akka-http-core | 0 → 10.5.3 |
| Maven | com.typesafe.akka:akka-http-core_2.11 | 0 → ∞ |
| Maven | com.typesafe.akka:akka-http-core_2.12 | 0 → 10.5.3 |
| Maven | com.typesafe.akka:akka-http-core_2.13 | 0 → 10.5.3 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 10.0.0 → 10.1.14 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 11.0.0-M1 → 11.0.0-M12 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 8.5.0 → 8.5.94 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.0 → 9.0.81 |
| Maven | org.apache.tomcat:tomcat-coyote | 10.0.0 → 10.1.14 |
| Maven | org.apache.tomcat:tomcat-coyote | 11.0.0-M1 → 11.0.0-M12 |
| Maven | org.apache.tomcat:tomcat-coyote | 8.5.0 → 8.5.94 |
| Maven | org.apache.tomcat:tomcat-coyote | 9.0.0 → 9.0.81 |
| Maven | org.eclipse.jetty.http2:http2-common | 10.0.0 → 10.0.17 |
| Maven | org.eclipse.jetty.http2:http2-common | 11.0.0 → 11.0.17 |
| Maven | org.eclipse.jetty.http2:http2-common | 9.3.0 → 9.4.53 |
| Maven | org.eclipse.jetty.http2:http2-server | 10.0.0 → 10.0.17 |
| Maven | org.eclipse.jetty.http2:http2-server | 11.0.0 → 11.0.17 |
| Maven | org.eclipse.jetty.http2:http2-server | 9.3.0 → 9.4.53 |
| Maven | org.eclipse.jetty.http2:jetty-http2-common | 12.0.0 → 12.0.2 |
| Maven | org.eclipse.jetty.http2:jetty-http2-server | 12.0.0 → 12.0.2 |
| SwiftURL | github.com/apple/swift-nio-http2 | 0 → 1.28.0 |
References
- http://www.openwall.com/lists/oss-security/2023/10/10/6
- http://www.openwall.com/lists/oss-security/2023/10/10/7
- http://www.openwall.com/lists/oss-security/2023/10/13/4
- http://www.openwall.com/lists/oss-security/2023/10/13/9
- http://www.openwall.com/lists/oss-security/2023/10/18/4
- http://www.openwall.com/lists/oss-security/2023/10/18/8
- http://www.openwall.com/lists/oss-security/2023/10/19/6
- http://www.openwall.com/lists/oss-security/2023/10/20/8
- https://access.redhat.com/security/cve/cve-2023-44487
- https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/
- https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
Status: profiled · ingested 2026-08-12T00:00:50.000Z