Actively exploited · Published Oct 10, 2023 · Assigned by mitre
CVE-2023-44487
High 7.5 Exploited
In plain English
A high-severity uncontrolled resource consumption in HTTP/2 from IETF. Attackers are actively exploiting it in the wild (listed by CISA on October 10, 2023). The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)100.0%top 0.0% of all CVEs
Exploited in the wildYesCISA KEV since Oct 10, 2023
Attack tooling1Public PoC
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Oct 31, 2023.
Official description
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | aspnetcore-runtime-6.0 | 6.0.23-1.el8_8 | ALSA-2023:5710 |
| AlmaLinux:9 | aspnetcore-runtime-6.0 | 6.0.23-1.el9_2 | ALSA-2023:5708 |
| AlmaLinux:8 | aspnetcore-runtime-7.0 | 7.0.12-1.el8_8 | ALSA-2023:5709 |
| AlmaLinux:9 | aspnetcore-runtime-7.0 | 7.0.12-1.el9_2 | ALSA-2023:5749 |
| AlmaLinux:8 | aspnetcore-targeting-pack-6.0 | 6.0.23-1.el8_8 | ALSA-2023:5710 |
| AlmaLinux:9 | aspnetcore-targeting-pack-6.0 | 6.0.23-1.el9_2 | ALSA-2023:5708 |
| AlmaLinux:8 | aspnetcore-targeting-pack-7.0 | 7.0.12-1.el8_8 | ALSA-2023:5709 |
| AlmaLinux:9 | aspnetcore-targeting-pack-7.0 | 7.0.12-1.el9_2 | ALSA-2023:5749 |
| AlmaLinux:8 | delve | 1.9.1-1.module_el8.8.0+3471+a62632a0 | ALSA-2023:5721 |
| AlmaLinux:8 | dotnet | 7.0.112-1.el8_8 | ALSA-2023:5709 |
| AlmaLinux:8 | dotnet-apphost-pack-6.0 | 6.0.23-1.el8_8 | ALSA-2023:5710 |
| AlmaLinux:9 | dotnet-apphost-pack-6.0 | 6.0.23-1.el9_2 | ALSA-2023:5708 |
| AlmaLinux:8 | dotnet-apphost-pack-7.0 | 7.0.12-1.el8_8 | ALSA-2023:5709 |
| AlmaLinux:9 | dotnet-apphost-pack-7.0 | 7.0.12-1.el9_2 | ALSA-2023:5749 |
| AlmaLinux:8 | dotnet-host | 7.0.12-1.el8_8 | ALSA-2023:5709 |
| AlmaLinux:9 | dotnet-host | 7.0.12-1.el9_2 | ALSA-2023:5749 |
| AlmaLinux:8 | dotnet-hostfxr-6.0 | 6.0.23-1.el8_8 | ALSA-2023:5710 |
| AlmaLinux:9 | dotnet-hostfxr-6.0 | 6.0.23-1.el9_2 | ALSA-2023:5708 |
| AlmaLinux:8 | dotnet-hostfxr-7.0 | 7.0.12-1.el8_8 | ALSA-2023:5709 |
| AlmaLinux:9 | dotnet-hostfxr-7.0 | 7.0.12-1.el9_2 | ALSA-2023:5749 |
| AlmaLinux:8 | dotnet-runtime-6.0 | 6.0.23-1.el8_8 | ALSA-2023:5710 |
| AlmaLinux:9 | dotnet-runtime-6.0 | 6.0.23-1.el9_2 | ALSA-2023:5708 |
| AlmaLinux:8 | dotnet-runtime-7.0 | 7.0.12-1.el8_8 | ALSA-2023:5709 |
| AlmaLinux:9 | dotnet-runtime-7.0 | 7.0.12-1.el9_2 | ALSA-2023:5749 |
| AlmaLinux:8 | dotnet-sdk-6.0 | 6.0.123-1.el8_8 | ALSA-2023:5710 |
| AlmaLinux:9 | dotnet-sdk-6.0 | 6.0.123-1.el9_2 | ALSA-2023:5708 |
| AlmaLinux:8 | dotnet-sdk-6.0-source-built-artifacts | 6.0.123-1.el8_8 | ALSA-2023:5710 |
| AlmaLinux:9 | dotnet-sdk-6.0-source-built-artifacts | 6.0.123-1.el9_2 | ALSA-2023:5708 |
| AlmaLinux:8 | dotnet-sdk-7.0 | 7.0.112-1.el8_8 | ALSA-2023:5709 |
| AlmaLinux:9 | dotnet-sdk-7.0 | 7.0.112-1.el9_2 | ALSA-2023:5749 |
| AlmaLinux:8 | dotnet-sdk-7.0-source-built-artifacts | 7.0.112-1.el8_8 | ALSA-2023:5709 |
| AlmaLinux:9 | dotnet-sdk-7.0-source-built-artifacts | 7.0.112-1.el9_2 | ALSA-2023:5749 |
| AlmaLinux:8 | dotnet-targeting-pack-6.0 | 6.0.23-1.el8_8 | ALSA-2023:5710 |
| AlmaLinux:9 | dotnet-targeting-pack-6.0 | 6.0.23-1.el9_2 | ALSA-2023:5708 |
| AlmaLinux:8 | dotnet-targeting-pack-7.0 | 7.0.12-1.el8_8 | ALSA-2023:5709 |
| AlmaLinux:9 | dotnet-targeting-pack-7.0 | 7.0.12-1.el9_2 | ALSA-2023:5749 |
| AlmaLinux:8 | dotnet-templates-6.0 | 6.0.123-1.el8_8 | ALSA-2023:5710 |
| AlmaLinux:9 | dotnet-templates-6.0 | 6.0.123-1.el9_2 | ALSA-2023:5708 |
| AlmaLinux:8 | dotnet-templates-7.0 | 7.0.112-1.el8_8 | ALSA-2023:5709 |
| AlmaLinux:9 | dotnet-templates-7.0 | 7.0.112-1.el9_2 | ALSA-2023:5749 |
| AlmaLinux:8 | go-toolset | 1.19.13-1.module_el8.8.0+3625+a06035cf | ALSA-2023:5721 |
| AlmaLinux:9 | go-toolset | 1.19.13-1.el9_2 | ALSA-2023:5738 |
| AlmaLinux:8 | golang | 1.19.13-1.module_el8.8.0+3625+a06035cf | ALSA-2023:5721 |
| AlmaLinux:9 | golang | 1.19.13-1.el9_2 | ALSA-2023:5738 |
| AlmaLinux:8 | golang-bin | 1.19.13-1.module_el8.8.0+3625+a06035cf | ALSA-2023:5721 |
| AlmaLinux:9 | golang-bin | 1.19.13-1.el9_2 | ALSA-2023:5738 |
| AlmaLinux:8 | golang-docs | 1.19.13-1.module_el8.8.0+3625+a06035cf | ALSA-2023:5721 |
| AlmaLinux:9 | golang-docs | 1.19.13-1.el9_2 | ALSA-2023:5738 |
| AlmaLinux:8 | golang-misc | 1.19.13-1.module_el8.8.0+3625+a06035cf | ALSA-2023:5721 |
| AlmaLinux:9 | golang-misc | 1.19.13-1.el9_2 | ALSA-2023:5738 |
| AlmaLinux:8 | golang-race | 1.19.13-1.module_el8.8.0+3625+a06035cf | ALSA-2023:5721 |
| AlmaLinux:9 | golang-race | 1.19.13-1.el9_2 | ALSA-2023:5738 |
| AlmaLinux:8 | golang-src | 1.19.13-1.module_el8.8.0+3625+a06035cf | ALSA-2023:5721 |
| AlmaLinux:9 | golang-src | 1.19.13-1.el9_2 | ALSA-2023:5738 |
| AlmaLinux:8 | golang-tests | 1.19.13-1.module_el8.8.0+3625+a06035cf | ALSA-2023:5721 |
| AlmaLinux:9 | golang-tests | 1.19.13-1.el9_2 | ALSA-2023:5738 |
| AlmaLinux:8 | grafana | 7.5.15-5.el8_8.alma.1 | ALSA-2023:5863 |
| AlmaLinux:9 | grafana | 9.0.9-4.el9_2.alma.1 | ALSA-2023:5867 |
| AlmaLinux:8 | httpd | 2.4.37-64.module_el8.10.0+3761+75f8c656 | ALSA-2024:3121 |
| AlmaLinux:8 | httpd-devel | 2.4.37-64.module_el8.10.0+3761+75f8c656 | ALSA-2024:3121 |
| AlmaLinux:8 | httpd-filesystem | 2.4.37-64.module_el8.10.0+3761+75f8c656 | ALSA-2024:3121 |
| AlmaLinux:8 | httpd-manual | 2.4.37-64.module_el8.10.0+3761+75f8c656 | ALSA-2024:3121 |
| AlmaLinux:8 | httpd-tools | 2.4.37-64.module_el8.10.0+3761+75f8c656 | ALSA-2024:3121 |
| AlmaLinux:8 | libnghttp2 | 1.33.0-5.el8_8 | ALSA-2023:5837 |
| AlmaLinux:9 | libnghttp2 | 1.43.0-5.el9_2.1 | ALSA-2023:5838 |
| AlmaLinux:9 | libnghttp2 | 1.43.0-5.el9_3.1 | ALSA-2023:6746 |
| AlmaLinux:8 | libnghttp2-devel | 1.33.0-5.el8_8 | ALSA-2023:5837 |
| AlmaLinux:9 | libnghttp2-devel | 1.43.0-5.el9_2.1 | ALSA-2023:5838 |
| AlmaLinux:9 | libnghttp2-devel | 1.43.0-5.el9_3.1 | ALSA-2023:6746 |
| AlmaLinux:8 | mod_http2 | 1.15.7-10.module_el8.10.0+3832+564e7653 | ALSA-2024:3121 |
| AlmaLinux:9 | mod_http2 | 2.0.26-1.el9 | ALSA-2024:2368 |
| AlmaLinux:8 | mod_ldap | 2.4.37-64.module_el8.10.0+3761+75f8c656 | ALSA-2024:3121 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa | ALSA-2024:3121 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.6.0+3031+fb177b09 | ALSA-2024:3121 |
| AlmaLinux:8 | mod_proxy_html | 1:2.4.37-64.module_el8.10.0+3761+75f8c656 | ALSA-2024:3121 |
| AlmaLinux:8 | mod_session | 2.4.37-64.module_el8.10.0+3761+75f8c656 | ALSA-2024:3121 |
| AlmaLinux:8 | mod_ssl | 1:2.4.37-64.module_el8.10.0+3761+75f8c656 | ALSA-2024:3121 |
| AlmaLinux:8 | netstandard-targeting-pack-2.1 | 7.0.112-1.el8_8 | ALSA-2023:5709 |
| AlmaLinux:9 | netstandard-targeting-pack-2.1 | 7.0.112-1.el9_2 | ALSA-2023:5749 |
| AlmaLinux:8 | nghttp2 | 1.33.0-5.el8_8 | ALSA-2023:5837 |
| AlmaLinux:9 | nghttp2 | 1.43.0-5.el9_3.1 | ALSA-2023:6746 |
| AlmaLinux:9 | nghttp2 | 1.43.0-5.el9_2.1 | ALSA-2023:5838 |
| AlmaLinux:8 | nginx | 1:1.22.1-1.module_el8.8.0+3623+f96e6422.1.alma.1 | ALSA-2023:5713 |
| AlmaLinux:8 | nginx | 1:1.20.1-1.module_el8.8.0+3624+abf02be4.1.alma.1 | ALSA-2023:5712 |
| AlmaLinux:9 | nginx | 1:1.22.1-3.module_el9.2.0+44+f932b372.1.alma.1 | ALSA-2023:6120 |
| AlmaLinux:9 | nginx | 1:1.20.1-14.el9_2.1.alma.1 | ALSA-2023:5711 |
| AlmaLinux:8 | nginx-all-modules | 1:1.22.1-1.module_el8.8.0+3623+f96e6422.1.alma.1 | ALSA-2023:5713 |
| AlmaLinux:8 | nginx-all-modules | 1:1.20.1-1.module_el8.8.0+3624+abf02be4.1.alma.1 | ALSA-2023:5712 |
| AlmaLinux:9 | nginx-all-modules | 1:1.20.1-14.el9_2.1.alma.1 | ALSA-2023:5711 |
| AlmaLinux:9 | nginx-all-modules | 1:1.22.1-3.module_el9.2.0+44+f932b372.1.alma.1 | ALSA-2023:6120 |
| AlmaLinux:9 | nginx-core | 1:1.20.1-14.el9_2.1.alma.1 | ALSA-2023:5711 |
| AlmaLinux:9 | nginx-core | 1:1.22.1-3.module_el9.2.0+44+f932b372.1.alma.1 | ALSA-2023:6120 |
| AlmaLinux:8 | nginx-filesystem | 1:1.20.1-1.module_el8.8.0+3624+abf02be4.1.alma.1 | ALSA-2023:5712 |
| AlmaLinux:8 | nginx-filesystem | 1:1.22.1-1.module_el8.8.0+3623+f96e6422.1.alma.1 | ALSA-2023:5713 |
| AlmaLinux:9 | nginx-filesystem | 1:1.22.1-3.module_el9.2.0+44+f932b372.1.alma.1 | ALSA-2023:6120 |
| AlmaLinux:9 | nginx-filesystem | 1:1.20.1-14.el9_2.1.alma.1 | ALSA-2023:5711 |
| AlmaLinux:8 | nginx-mod-devel | 1:1.20.1-1.module_el8.8.0+3624+abf02be4.1.alma.1 | ALSA-2023:5712 |
| AlmaLinux:8 | nginx-mod-devel | 1:1.22.1-1.module_el8.8.0+3623+f96e6422.1.alma.1 | ALSA-2023:5713 |
| AlmaLinux:9 | nginx-mod-devel | 1:1.22.1-3.module_el9.2.0+44+f932b372.1.alma.1 | ALSA-2023:6120 |
| AlmaLinux:9 | nginx-mod-devel | 1:1.20.1-14.el9_2.1.alma.1 | ALSA-2023:5711 |
| AlmaLinux:8 | nginx-mod-http-image-filter | 1:1.22.1-1.module_el8.8.0+3623+f96e6422.1.alma.1 | ALSA-2023:5713 |
| AlmaLinux:8 | nginx-mod-http-image-filter | 1:1.20.1-1.module_el8.8.0+3624+abf02be4.1.alma.1 | ALSA-2023:5712 |
| AlmaLinux:9 | nginx-mod-http-image-filter | 1:1.22.1-3.module_el9.2.0+44+f932b372.1.alma.1 | ALSA-2023:6120 |
| AlmaLinux:9 | nginx-mod-http-image-filter | 1:1.20.1-14.el9_2.1.alma.1 | ALSA-2023:5711 |
| AlmaLinux:8 | nginx-mod-http-perl | 1:1.20.1-1.module_el8.8.0+3624+abf02be4.1.alma.1 | ALSA-2023:5712 |
| AlmaLinux:8 | nginx-mod-http-perl | 1:1.22.1-1.module_el8.8.0+3623+f96e6422.1.alma.1 | ALSA-2023:5713 |
| AlmaLinux:9 | nginx-mod-http-perl | 1:1.22.1-3.module_el9.2.0+44+f932b372.1.alma.1 | ALSA-2023:6120 |
| AlmaLinux:9 | nginx-mod-http-perl | 1:1.20.1-14.el9_2.1.alma.1 | ALSA-2023:5711 |
| AlmaLinux:8 | nginx-mod-http-xslt-filter | 1:1.22.1-1.module_el8.8.0+3623+f96e6422.1.alma.1 | ALSA-2023:5713 |
| AlmaLinux:8 | nginx-mod-http-xslt-filter | 1:1.20.1-1.module_el8.8.0+3624+abf02be4.1.alma.1 | ALSA-2023:5712 |
| AlmaLinux:9 | nginx-mod-http-xslt-filter | 1:1.20.1-14.el9_2.1.alma.1 | ALSA-2023:5711 |
| AlmaLinux:9 | nginx-mod-http-xslt-filter | 1:1.22.1-3.module_el9.2.0+44+f932b372.1.alma.1 | ALSA-2023:6120 |
| AlmaLinux:8 | nginx-mod-mail | 1:1.22.1-1.module_el8.8.0+3623+f96e6422.1.alma.1 | ALSA-2023:5713 |
| AlmaLinux:8 | nginx-mod-mail | 1:1.20.1-1.module_el8.8.0+3624+abf02be4.1.alma.1 | ALSA-2023:5712 |
| AlmaLinux:9 | nginx-mod-mail | 1:1.22.1-3.module_el9.2.0+44+f932b372.1.alma.1 | ALSA-2023:6120 |
| AlmaLinux:9 | nginx-mod-mail | 1:1.20.1-14.el9_2.1.alma.1 | ALSA-2023:5711 |
| AlmaLinux:8 | nginx-mod-stream | 1:1.20.1-1.module_el8.8.0+3624+abf02be4.1.alma.1 | ALSA-2023:5712 |
| AlmaLinux:8 | nginx-mod-stream | 1:1.22.1-1.module_el8.8.0+3623+f96e6422.1.alma.1 | ALSA-2023:5713 |
| AlmaLinux:9 | nginx-mod-stream | 1:1.20.1-14.el9_2.1.alma.1 | ALSA-2023:5711 |
| AlmaLinux:9 | nginx-mod-stream | 1:1.22.1-3.module_el9.2.0+44+f932b372.1.alma.1 | ALSA-2023:6120 |
| AlmaLinux:8 | nodejs | 1:18.18.2-1.module_el8.8.0+3652+0e111ba0 | ALSA-2023:5869 |
| AlmaLinux:8 | nodejs | 1:16.20.2-3.module_el8.8.0+3653+c77a731f | ALSA-2023:5850 |
| AlmaLinux:8 | nodejs | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | ALSA-2023:7205 |
| AlmaLinux:8 | nodejs | 1:16.20.2-4.module_el8.9.0+3747+ead8229c | ALSA-2024:1444 |
| AlmaLinux:9 | nodejs | 1:18.18.2-2.module_el9.2.0+43+3ebc9e20 | ALSA-2023:5849 |
| AlmaLinux:9 | nodejs | 1:16.20.2-3.el9_2 | ALSA-2023:5765 |
| AlmaLinux:8 | nodejs-devel | 1:18.18.2-1.module_el8.8.0+3652+0e111ba0 | ALSA-2023:5869 |
| AlmaLinux:8 | nodejs-devel | 1:16.20.2-4.module_el8.9.0+3747+ead8229c | ALSA-2024:1444 |
| AlmaLinux:8 | nodejs-devel | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | ALSA-2023:7205 |
| AlmaLinux:8 | nodejs-devel | 1:16.20.2-3.module_el8.8.0+3653+c77a731f | ALSA-2023:5850 |
| AlmaLinux:9 | nodejs-devel | 1:18.18.2-2.module_el9.2.0+43+3ebc9e20 | ALSA-2023:5849 |
| AlmaLinux:8 | nodejs-docs | 1:16.20.2-4.module_el8.9.0+3747+ead8229c | ALSA-2024:1444 |
| AlmaLinux:8 | nodejs-docs | 1:18.18.2-1.module_el8.8.0+3652+0e111ba0 | ALSA-2023:5869 |
| AlmaLinux:8 | nodejs-docs | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | ALSA-2023:7205 |
| AlmaLinux:8 | nodejs-docs | 1:16.20.2-3.module_el8.8.0+3653+c77a731f | ALSA-2023:5850 |
| AlmaLinux:9 | nodejs-docs | 1:16.20.2-3.el9_2 | ALSA-2023:5765 |
| AlmaLinux:9 | nodejs-docs | 1:18.18.2-2.module_el9.2.0+43+3ebc9e20 | ALSA-2023:5849 |
| AlmaLinux:8 | nodejs-full-i18n | 1:16.20.2-4.module_el8.9.0+3747+ead8229c | ALSA-2024:1444 |
| AlmaLinux:8 | nodejs-full-i18n | 1:18.18.2-1.module_el8.8.0+3652+0e111ba0 | ALSA-2023:5869 |
| AlmaLinux:8 | nodejs-full-i18n | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | ALSA-2023:7205 |
| AlmaLinux:8 | nodejs-full-i18n | 1:16.20.2-3.module_el8.8.0+3653+c77a731f | ALSA-2023:5850 |
| AlmaLinux:9 | nodejs-full-i18n | 1:16.20.2-3.el9_2 | ALSA-2023:5765 |
| AlmaLinux:9 | nodejs-full-i18n | 1:18.18.2-2.module_el9.2.0+43+3ebc9e20 | ALSA-2023:5849 |
| AlmaLinux:9 | nodejs-libs | 1:16.20.2-3.el9_2 | ALSA-2023:5765 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.8.0+3614+204d6f43 | ALSA-2024:1444 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.8.0+3614+204d6f43 | ALSA-2023:5850 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.8.0+3613+1ed8c91d | ALSA-2023:5869 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.9.0+3675+0258a6d9 | ALSA-2023:7205 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.2.0+36+853e48f5 | ALSA-2023:5849 |
| AlmaLinux:8 | nodejs-packaging | 26-1.module_el8.8.0+3614+204d6f43 | ALSA-2024:1444 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2023:5869 |
| AlmaLinux:8 | nodejs-packaging | 26-1.module_el8.8.0+3614+204d6f43 | ALSA-2023:5850 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 | ALSA-2023:7205 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2023:5849 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2023:5869 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 | ALSA-2023:7205 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2023:5849 |
| AlmaLinux:8 | npm | 1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9 | ALSA-2023:7205 |
| AlmaLinux:8 | npm | 1:8.19.4-1.16.20.2.3.module_el8.8.0+3653+c77a731f | ALSA-2023:5850 |
| AlmaLinux:8 | npm | 1:8.19.4-1.16.20.2.4.module_el8.9.0+3747+ead8229c | ALSA-2024:1444 |
| AlmaLinux:8 | npm | 1:9.8.1-1.18.18.2.1.module_el8.8.0+3652+0e111ba0 | ALSA-2023:5869 |
| AlmaLinux:9 | npm | 1:8.19.4-1.16.20.2.3.el9_2 | ALSA-2023:5765 |
| AlmaLinux:9 | npm | 1:9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20 | ALSA-2023:5849 |
| AlmaLinux:8 | tomcat | 1:9.0.62-5.el8_8.2 | ALSA-2023:5928 |
| AlmaLinux:9 | tomcat | 1:9.0.62-11.el9_2.3 | ALSA-2023:5929 |
| AlmaLinux:8 | tomcat-admin-webapps | 1:9.0.62-5.el8_8.2 | ALSA-2023:5928 |
| AlmaLinux:9 | tomcat-admin-webapps | 1:9.0.62-11.el9_2.3 | ALSA-2023:5929 |
| AlmaLinux:8 | tomcat-docs-webapp | 1:9.0.62-5.el8_8.2 | ALSA-2023:5928 |
| AlmaLinux:9 | tomcat-docs-webapp | 1:9.0.62-11.el9_2.3 | ALSA-2023:5929 |
| AlmaLinux:8 | tomcat-el-3.0-api | 1:9.0.62-5.el8_8.2 | ALSA-2023:5928 |
| AlmaLinux:9 | tomcat-el-3.0-api | 1:9.0.62-11.el9_2.3 | ALSA-2023:5929 |
| AlmaLinux:8 | tomcat-jsp-2.3-api | 1:9.0.62-5.el8_8.2 | ALSA-2023:5928 |
| AlmaLinux:9 | tomcat-jsp-2.3-api | 1:9.0.62-11.el9_2.3 | ALSA-2023:5929 |
| AlmaLinux:8 | tomcat-lib | 1:9.0.62-5.el8_8.2 | ALSA-2023:5928 |
| AlmaLinux:9 | tomcat-lib | 1:9.0.62-11.el9_2.3 | ALSA-2023:5929 |
| AlmaLinux:8 | tomcat-servlet-4.0-api | 1:9.0.62-5.el8_8.2 | ALSA-2023:5928 |
| AlmaLinux:9 | tomcat-servlet-4.0-api | 1:9.0.62-11.el9_2.3 | ALSA-2023:5929 |
| AlmaLinux:8 | tomcat-webapps | 1:9.0.62-5.el8_8.2 | ALSA-2023:5928 |
| AlmaLinux:9 | tomcat-webapps | 1:9.0.62-11.el9_2.3 | ALSA-2023:5929 |
| AlmaLinux:9 | toolbox | 0.0.99.3-10.el9_2 | ALSA-2023:6077 |
| AlmaLinux:9 | toolbox-tests | 0.0.99.3-10.el9_2 | ALSA-2023:6077 |
| AlmaLinux:8 | varnish | 6.0.8-3.module_el8.8.0+3665+0b8dabc5.1.alma.1 | ALSA-2023:5989 |
| AlmaLinux:9 | varnish | 6.6.2-3.el9_2.1 | ALSA-2023:5924 |
| AlmaLinux:8 | varnish-devel | 6.0.8-3.module_el8.8.0+3665+0b8dabc5.1.alma.1 | ALSA-2023:5989 |
| AlmaLinux:9 | varnish-devel | 6.6.2-3.el9_2.1 | ALSA-2023:5924 |
| AlmaLinux:8 | varnish-docs | 6.0.8-3.module_el8.8.0+3665+0b8dabc5.1.alma.1 | ALSA-2023:5989 |
| AlmaLinux:9 | varnish-docs | 6.6.2-3.el9_2.1 | ALSA-2023:5924 |
| AlmaLinux:8 | varnish-modules | 0.15.0-6.module_el8.6.0+3089+dac88e97 | ALSA-2023:5989 |
| AlmaLinux:8 | varnish-modules | 0.15.0-6.module_el8.5.0+2620+03a0c2cc | ALSA-2023:5989 |
| AlmaLinux:8 | varnish-modules | 0.15.0-6.module_el8.5.0+76+a10ffa55 | ALSA-2023:5989 |
| Alpine:v3.20 | dotnet6-build | 6.0.123-r0, 6.0.124-r0 | ALPINE-CVE-2023-44487 |
| Alpine:v3.20 | dotnet6-runtime | 6.0.23-r0, 6.0.24-r0 | ALPINE-CVE-2023-44487 |
| Alpine:v3.20 | go | 1.21.3-r0 | ALPINE-CVE-2023-44487 |
| Alpine:v3.21 | go | 1.21.3-r0 | ALPINE-CVE-2023-44487 |
| Alpine:v3.22 | go | 1.21.3-r0 | ALPINE-CVE-2023-44487 |
| Alpine:v3.23 | go | 1.21.3-r0 | ALPINE-CVE-2023-44487 |
| Alpine:v3.24 | go | 1.21.3-r0 | ALPINE-CVE-2023-44487 |
| Alpine:v3.20 | grpc | 1.59.3-r0 | ALPINE-CVE-2023-44487 |
| Alpine:v3.21 | grpc | 1.59.3-r0 | ALPINE-CVE-2023-44487 |
| Alpine:v3.22 | grpc | 1.59.3-r0 | ALPINE-CVE-2023-44487 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73
- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
- https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
- https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack
- https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
- https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/
- https://news.ycombinator.com/item?id=37831062
- https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/
- https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack
- https://github.com/envoyproxy/envoy/pull/30055
- https://github.com/haproxy/haproxy/issues/2312
- https://github.com/eclipse/jetty.project/issues/10679
- https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764
- https://github.com/nghttp2/nghttp2/pull/1961
- https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
- https://github.com/alibaba/tengine/issues/1872
- https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2
- https://news.ycombinator.com/item?id=37830987
- https://news.ycombinator.com/item?id=37830998
- https://github.com/caddyserver/caddy/issues/5877
- https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/
- https://github.com/bcdannyboy/CVE-2023-44487
- https://github.com/grpc/grpc-go/pull/6703
- https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244
- https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0
- https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html
- https://my.f5.com/manage/s/article/K000137106
- https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/
- https://bugzilla.proxmox.com/show_bug.cgi?id=4988
- https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9
- [oss-security] 20231010 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations mailing-list
- [oss-security] 20231010 CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations mailing-list
- https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected
- https://github.com/microsoft/CBL-Mariner/pull/6381
- https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo
- https://github.com/facebook/proxygen/pull/466
- https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088
- https://github.com/micrictor/http2-rst-stream
- https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve
- https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/