[ CVE-2023-44487 · Published 10 Oct 2023 ]
HTTP/2 Rapid Reset Attack Vulnerability
Exploited · CISA KEV CVSS 7.5
EPSS 100%Fix available
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-10-10
- EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)
[ Description ]Official description
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CISA: HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 31 Oct 2023): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Patch on cgit.freebsd.orgVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on gist.github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ References ]References
- www.openwall.com/lists/oss-security/2023/10/10/6Mailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2023/10/10/7Mailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2023/10/13/4Mailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2023/10/13/9Mailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2023/10/18/4Mailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2023/10/18/8Mailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2023/10/19/6Mailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2023/10/20/8Mailing ListThird Party Advisory
- access.redhat.com/security/cve/cve-2023-44487Vendor Advisory
- arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attack…Press/Media CoverageThird Party Advisory
- aws.amazon.com/security/security-bulletins/AWS-2023-011Third Party Advisory
- blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attackTechnical DescriptionVendor Advisory
- blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attackThird Party AdvisoryVendor Advisory
- blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerabliltyVendor Advisory
- blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-…Press/Media CoverageThird Party Advisory
- blog.vespa.ai/cve-2023-44487Vendor Advisory
- bugzilla.proxmox.com/show_bug.cgiIssue TrackingThird Party Advisory
- bugzilla.redhat.com/show_bug.cgiIssue TrackingVendor Advisory
- bugzilla.suse.com/show_bug.cgiIssue TrackingVendor Advisory
- cgit.freebsd.org/ports/commitMailing ListPatchVendor Advisory
- cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-at…Technical DescriptionVendor Advisory
- cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-res…Technical DescriptionVendor Advisory
- community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125Vendor Advisory
- discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapi…Third Party Advisory
- edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cveBroken Link
- forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764Vendor Advisory
- gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088Issue TrackingPatch
- github.com/Azure/AKS/issues/3947Issue Tracking
- github.com/Kong/kong/discussions/11741Issue Tracking
- github.com/advisories/GHSA-qppj-fm5r-hxr3Vendor Advisory
- github.com/advisories/GHSA-vx74-f528-fxqgMitigationPatchVendor Advisory
- github.com/advisories/GHSA-xpw8-rcwv-8f8pPatchVendor Advisory
- github.com/akka/akka-http/issues/4323Issue Tracking
- github.com/alibaba/tengine/issues/1872Issue Tracking
- github.com/apache/apisix/issues/10320Issue Tracking
- github.com/apache/httpd-site/pull/10Issue Tracking
- github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_…Product
- github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2ProductThird Party Advisory
- github.com/apache/trafficserver/pull/10564Issue TrackingPatch
- github.com/arkrwn/PoC/tree/main/CVE-2023-44487Vendor Advisory