CVEs / CVE-2023-44487

CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability

• Known exploited in the CISA KEV catalog since 10 Oct 2023
• high 7.5 CVSS 3.1 (NVD)
• EPSS 99.9% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
• Last changed at its sources 31 Oct 2026

Summary

HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).

Description

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Affected and fixed versions

Package versions from GHSA-qppj-fm5r-hxr3, GHSA-vx74-f528-fxqg.

Exploitation

Severity

References

• CVE-2023-44487 on NVD
• CVE-2023-44487 in the CISA KEV catalog
• https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487 (cited by CISA)
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ (cited by CISA)
• CVE-2023-44487 on OSV
• http://www.openwall.com/lists/oss-security/2023/10/10/6 Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/10/10/7 Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/10/13/4 Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/10/13/9 Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/10/18/4 Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/10/18/8 Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/10/19/6 Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/10/20/8 Mailing List, Third Party Advisory
• https://access.redhat.com/security/cve/cve-2023-44487 Vendor Advisory
• https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/ Press/Media Coverage, Third Party Advisory
• https://aws.amazon.com/security/security-bulletins/AWS-2023-011/ Third Party Advisory
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ Technical Description, Vendor Advisory
• https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/ Third Party Advisory, Vendor Advisory
• https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/ Vendor Advisory
• https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack Press/Media Coverage, Third Party Advisory
• https://blog.vespa.ai/cve-2023-44487/ Vendor Advisory
• https://bugzilla.proxmox.com/show_bug.cgi?id=4988 Issue Tracking, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2242803 Issue Tracking, Vendor Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1216123 Issue Tracking, Vendor Advisory
• https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 Mailing List, Patch, Vendor Advisory