CVE-2023-44487

Published: Oct 10, 2023Modified: Jun 17, 2026CISA KEV

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Affected (300)

Products: Siemens: Simatic S7 1500 Cpu 1518f 4 Pn/dp Mfp Firmware, Sinec Ins, Sinec Nms, St7 Scadaconnect, Ruggedcom Ape1808 Firmware, Simatic S7 1500 Cpu 1518 4 Pn/dp Mfp Firmware, Siplus S7 1500 Cpu 1518 4 Pn/dp Mfp Firmware · Ietf: Http · Nghttp2: Nghttp2 · +30 more

Show all products

Siemens: Simatic S7 1500 Cpu 1518f 4 Pn/dp Mfp Firmware, Sinec Ins, Sinec Nms, St7 Scadaconnect, Ruggedcom Ape1808 Firmware, Simatic S7 1500 Cpu 1518 4 Pn/dp Mfp Firmware, Siplus S7 1500 Cpu 1518 4 Pn/dp Mfp Firmware · Ietf: Http · Nghttp2: Nghttp2 · Netty: Netty · Envoyproxy: Envoy · Eclipse: Jetty · Caddyserver: Caddy · Golang: Go, Http2, Networking · F5: Big Ip Access Policy Manager, Big Ip Advanced Firewall Manager, Big Ip Advanced Web Application Firewall, Big Ip Analytics, Big Ip Application Acceleration Manager, Big Ip Application Security Manager, Big Ip Application Visibility And Reporting, Big Ip Carrier Grade Nat, Big Ip Ddos Hybrid Defender, Big Ip Domain Name System, Big Ip Fraud Protection Service, Big Ip Global Traffic Manager, Big Ip Link Controller, Big Ip Local Traffic Manager, Big Ip Next, Big Ip Next Service Proxy For Kubernetes, Big Ip Policy Enforcement Manager, Big Ip Ssl Orchestrator, Big Ip Webaccelerator, Big Ip Websafe, Nginx, Nginx Ingress Controller, Nginx Plus · Apache: Tomcat, Apisix, Traffic Server, Solr · Apple: Swiftnio Http/2 · Grpc: Grpc · Microsoft: .net, Asp.net Core, Azure Kubernetes Service, Visual Studio 2022, Windows 10 1607, Windows 10 1809, Windows 10 21h2, Windows 10 22h2, Windows 11 21h2, Windows 11 22h2, Windows Server 2016, Windows Server 2019, Windows Server 2022, Cbl Mariner · Nodejs: Node.js · Dena: H2o · Facebook: Proxygen · Amazon: Opensearch Data Prepper · Debian: Debian Linux · Kazu Yamamoto: Http2 · Istio: Istio · Varnish Cache Project: Varnish Cache · Traefik: Traefik · Projectcontour: Contour · Linkerd: Linkerd · Linecorp: Armeria · Redhat: 3scale Api Management Platform, Advanced Cluster Management For Kubernetes, Advanced Cluster Security, Ansible Automation Platform, Build Of Optaplanner, Build Of Quarkus, Ceph Storage, Cert Manager Operator For Red Hat Openshift, Certification For Red Hat Enterprise Linux, Cost Management, Cryostat, Decision Manager, Enterprise Linux, Fence Agents Remediation Operator, Integration Camel For Spring Boot, Integration Camel K, Integration Service Registry, Jboss A Mq, Jboss A Mq Streams, Jboss Core Services, Jboss Data Grid, Jboss Enterprise Application Platform, Jboss Fuse, Logging Subsystem For Red Hat Openshift, Machine Deletion Remediation Operator, Migration Toolkit For Applications, Migration Toolkit For Containers, Migration Toolkit For Virtualization, Network Observability Operator, Node Healthcheck Operator, Node Maintenance Operator, Openshift, Openshift Api For Data Protection, Openshift Container Platform, Openshift Container Platform Assisted Installer, Openshift Data Science, Openshift Dev Spaces, Openshift Developer Tools And Services, Openshift Distributed Tracing, Openshift Gitops, Openshift Pipelines, Openshift Sandboxed Containers, Openshift Secondary Scheduler Operator, Openshift Serverless, Openshift Service Mesh, Openshift Virtualization, Openstack Platform, Process Automation, Quay, Run Once Duration Override Operator, Satellite, Self Node Remediation Operator, Service Interconnect, Single Sign On, Support For Spring Boot, Web Terminal, Service Telemetry Framework · Fedoraproject: Fedora · Netapp: Astra Control Center, Oncommand Insight · Akka: Http Server · Konghq: Kong Gateway · Jenkins: Jenkins · Openresty: Openresty · Cisco: Business Process Automation, Connected Mobile Experiences, Crosswork Data Gateway, Crosswork Situation Manager, Crosswork Zero Touch Provisioning, Data Center Network Manager, Enterprise Chat And Email, Expressway, Firepower Threat Defense, Fog Director, Ios Xe, Ios Xr, Iot Field Network Director, Prime Access Registrar, Prime Cable Provisioning, Prime Infrastructure, Prime Network Registrar, Secure Dynamic Attributes Connector, Secure Malware Analytics, Telepresence Video Communication Server, Ultra Cloud Core Policy Control Function, Ultra Cloud Core Serving Gateway Function, Ultra Cloud Core Session Management Function, Unified Attendant Console Advanced, Unified Contact Center Domain Manager, Unified Contact Center Enterprise, Unified Contact Center Enterprise Live Data Server, Unified Contact Center Management Portal, Secure Web Appliance Firmware, Nx Os

Siemens

7 products

Simatic S7 1500 Cpu 1518f 4 Pn/dp Mfp Firmware

Sinec Ins

Sinec Nms

St7 Scadaconnect

Ruggedcom Ape1808 Firmware

Simatic S7 1500 Cpu 1518 4 Pn/dp Mfp Firmware

Siplus S7 1500 Cpu 1518 4 Pn/dp Mfp Firmware

1 product

1 product

1 product

1 product

1 product

1 product

3 products

23 products

Big Ip Access Policy Manager

Big Ip Advanced Firewall Manager

Big Ip Advanced Web Application Firewall

Big Ip Analytics

Big Ip Application Acceleration Manager

Big Ip Application Security Manager

Big Ip Application Visibility And Reporting

Big Ip Carrier Grade Nat

Big Ip Ddos Hybrid Defender

Big Ip Domain Name System

Big Ip Fraud Protection Service

Big Ip Global Traffic Manager

Big Ip Link Controller

Big Ip Local Traffic Manager

Big Ip Next

Big Ip Next Service Proxy For Kubernetes

Big Ip Policy Enforcement Manager

Big Ip Ssl Orchestrator

Big Ip Webaccelerator

Big Ip Websafe

Nginx

Nginx Ingress Controller

4 products

1 product

1 product

14 products

Azure Kubernetes Service

1 product

1 product

1 product

1 product

Opensearch Data Prepper

1 product

1 product

1 product

Varnish Cache Project

1 product

1 product

1 product

1 product

1 product

57 products

3scale Api Management Platform

Advanced Cluster Management For Kubernetes

Advanced Cluster Security

Ansible Automation Platform

Build Of Optaplanner

Build Of Quarkus

Ceph Storage

Cert Manager Operator For Red Hat Openshift

Certification For Red Hat Enterprise Linux

Fence Agents Remediation Operator

Integration Camel For Spring Boot

Integration Camel K

Integration Service Registry

Jboss Enterprise Application Platform

Jboss Fuse

Logging Subsystem For Red Hat Openshift

Machine Deletion Remediation Operator

Migration Toolkit For Applications

Migration Toolkit For Containers

Migration Toolkit For Virtualization

Network Observability Operator

Node Healthcheck Operator

Node Maintenance Operator

Openshift

Openshift Api For Data Protection

Openshift Container Platform

Openshift Container Platform Assisted Installer

Openshift Data Science

Openshift Dev Spaces

Openshift Developer Tools And Services

Openshift Distributed Tracing

Openshift Gitops

Openshift Pipelines

Openshift Sandboxed Containers

Openshift Secondary Scheduler Operator

Openshift Serverless

Openshift Service Mesh

Openshift Virtualization

Openstack Platform

Process Automation

Quay

Run Once Duration Override Operator

Satellite

Self Node Remediation Operator

Service Interconnect

Single Sign On

Support For Spring Boot

Web Terminal

Service Telemetry Framework

1 product

2 products

1 product

1 product

1 product

1 product

30 products

Business Process Automation

Connected Mobile Experiences

Crosswork Data Gateway

Crosswork Situation Manager

Crosswork Zero Touch Provisioning

Data Center Network Manager

Enterprise Chat And Email

Expressway

Firepower Threat Defense

Fog Director

Ios Xe

Ios Xr

Iot Field Network Director

Prime Access Registrar

Prime Cable Provisioning

Prime Infrastructure

Prime Network Registrar

Secure Dynamic Attributes Connector

Secure Malware Analytics

Telepresence Video Communication Server

Ultra Cloud Core Policy Control Function

Ultra Cloud Core Serving Gateway Function

Ultra Cloud Core Session Management Function

Unified Attendant Console Advanced

Unified Contact Center Domain Manager

Unified Contact Center Enterprise

Unified Contact Center Enterprise Live Data Server

Unified Contact Center Management Portal

Secure Web Appliance Firmware

Nx Os

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic S7 1500 Cpu 1518f 4 Pn/dp Mfp Firmware	From 3.1.5

Running on/with	Platform Versions
Siemens Simatic S7 1500 Cpu 1518f 4 Pn/dp Mfp	All versions

Configuration B

8 vulnerable

Vulnerable Software	Affected Versions
Siemens Sinec Ins	Before 1.0
Siemens Sinec Ins	Version 1.0
Siemens Sinec Ins	Version 1.0 sp1
Siemens Sinec Ins	Version 1.0 sp2
Siemens Sinec Ins	Version 1.0 sp2_update_1
Siemens Sinec Ins	Version 1.0 sp2_update_2
Siemens Sinec Nms	Before 3.0
Siemens St7 Scadaconnect	Before 1.1

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Ruggedcom Ape1808 Firmware	All versions

Running on/with	Platform Versions
Siemens Ruggedcom Ape1808	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic S7 1500 Cpu 1518 4 Pn/dp Mfp Firmware	From 3.1.5

Running on/with	Platform Versions
Siemens Simatic S7 1500 Cpu 1518 4 Pn/dp	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Siplus S7 1500 Cpu 1518 4 Pn/dp Mfp Firmware	From 3.1.5

Running on/with	Platform Versions
Siemens Siplus S7 1500 Cpu 1518 4 Pn/dp Mfp	All versions

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Ietf Http	Version 2.0

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Nghttp2 Nghttp2	Before 1.57.0

Configuration H

1 vulnerable

Vulnerable Software	Affected Versions
Netty Netty	Before 4.1.100

Configuration I

4 vulnerable

Vulnerable Software	Affected Versions
Envoyproxy Envoy	Version 1.24.10
Envoyproxy Envoy	Version 1.25.9
Envoyproxy Envoy	Version 1.26.4
Envoyproxy Envoy	Version 1.27.0

Configuration J

4 vulnerable

Vulnerable Software	Affected Versions
Eclipse Jetty	Before 9.4.53
Eclipse Jetty	From 10.0.0 to 10.0.17
Eclipse Jetty	From 11.0.0 to 11.0.17
Eclipse Jetty	From 12.0.0 to 12.0.2

Configuration K

1 vulnerable

Vulnerable Software	Affected Versions
Caddyserver Caddy	Before 2.7.5

Configuration L

4 vulnerable

Vulnerable Software	Affected Versions
Golang Go	Before 1.20.10
Golang Go	From 1.21.0 to 1.21.3
Golang Http2	Before 0.17.0
Golang Networking	Before 0.17.0

Configuration M

98 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Access Policy Manager	From 13.1.0 to 13.1.5
F5 Big Ip Access Policy Manager	From 14.1.0 to 14.1.5
F5 Big Ip Access Policy Manager	From 15.1.0 to 15.1.10
F5 Big Ip Access Policy Manager	From 16.1.0 to 16.1.4
F5 Big Ip Access Policy Manager	Version 17.1.0
F5 Big Ip Advanced Firewall Manager	From 13.1.0 to 13.1.5
F5 Big Ip Advanced Firewall Manager	From 14.1.0 to 14.1.5
F5 Big Ip Advanced Firewall Manager	From 15.1.0 to 15.1.10
F5 Big Ip Advanced Firewall Manager	From 16.1.0 to 16.1.4
F5 Big Ip Advanced Firewall Manager	Version 17.1.0
F5 Big Ip Advanced Web Application Firewall	From 13.1.0 to 13.1.5
F5 Big Ip Advanced Web Application Firewall	From 14.1.0 to 14.1.5
F5 Big Ip Advanced Web Application Firewall	From 15.1.0 to 15.1.10
F5 Big Ip Advanced Web Application Firewall	From 16.1.0 to 16.1.4
F5 Big Ip Advanced Web Application Firewall	Version 17.1.0
F5 Big Ip Analytics	From 13.1.0 to 13.1.5
F5 Big Ip Analytics	From 14.1.0 to 14.1.5
F5 Big Ip Analytics	From 15.1.0 to 15.1.10
F5 Big Ip Analytics	From 16.1.0 to 16.1.4
F5 Big Ip Analytics	Version 17.1.0
F5 Big Ip Application Acceleration Manager	From 13.1.0 to 13.1.5
F5 Big Ip Application Acceleration Manager	From 14.1.0 to 14.1.5
F5 Big Ip Application Acceleration Manager	From 15.1.0 to 15.1.10
F5 Big Ip Application Acceleration Manager	From 16.1.0 to 16.1.4
F5 Big Ip Application Acceleration Manager	Version 17.1.0
F5 Big Ip Application Security Manager	From 13.1.0 to 13.1.5
F5 Big Ip Application Security Manager	From 14.1.0 to 14.1.5
F5 Big Ip Application Security Manager	From 15.1.0 to 15.1.10
F5 Big Ip Application Security Manager	From 16.1.0 to 16.1.4
F5 Big Ip Application Security Manager	Version 17.1.0
F5 Big Ip Application Visibility And Reporting	From 13.1.0 to 13.1.5
F5 Big Ip Application Visibility And Reporting	From 14.1.0 to 14.1.5
F5 Big Ip Application Visibility And Reporting	From 15.1.0 to 15.1.10
F5 Big Ip Application Visibility And Reporting	From 16.1.0 to 16.1.4
F5 Big Ip Application Visibility And Reporting	Version 17.1.0
F5 Big Ip Carrier Grade Nat	From 13.1.0 to 13.1.5
F5 Big Ip Carrier Grade Nat	From 14.1.0 to 14.1.5
F5 Big Ip Carrier Grade Nat	From 15.1.0 to 15.1.10
F5 Big Ip Carrier Grade Nat	From 16.1.0 to 16.1.4
F5 Big Ip Carrier Grade Nat	Version 17.1.0
F5 Big Ip Ddos Hybrid Defender	From 13.1.0 to 13.1.5
F5 Big Ip Ddos Hybrid Defender	From 14.1.0 to 14.1.5
F5 Big Ip Ddos Hybrid Defender	From 15.1.0 to 15.1.10
F5 Big Ip Ddos Hybrid Defender	From 16.1.0 to 16.1.4
F5 Big Ip Ddos Hybrid Defender	Version 17.1.0
F5 Big Ip Domain Name System	From 13.1.0 to 13.1.5
F5 Big Ip Domain Name System	From 14.1.0 to 14.1.5
F5 Big Ip Domain Name System	From 15.1.0 to 15.1.10
F5 Big Ip Domain Name System	From 16.1.0 to 16.1.4
F5 Big Ip Domain Name System	Version 17.1.0
F5 Big Ip Fraud Protection Service	From 13.1.0 to 13.1.5
F5 Big Ip Fraud Protection Service	From 14.1.0 to 14.1.5
F5 Big Ip Fraud Protection Service	From 15.1.0 to 15.1.10
F5 Big Ip Fraud Protection Service	From 16.1.0 to 16.1.4
F5 Big Ip Fraud Protection Service	Version 17.1.0
F5 Big Ip Global Traffic Manager	From 13.1.0 to 13.1.5
F5 Big Ip Global Traffic Manager	From 14.1.0 to 14.1.5
F5 Big Ip Global Traffic Manager	From 15.1.0 to 15.1.10
F5 Big Ip Global Traffic Manager	From 16.1.0 to 16.1.4
F5 Big Ip Global Traffic Manager	Version 17.1.0
F5 Big Ip Link Controller	From 13.1.0 to 13.1.5
F5 Big Ip Link Controller	From 14.1.0 to 14.1.5
F5 Big Ip Link Controller	From 15.1.0 to 15.1.10
F5 Big Ip Link Controller	From 16.1.0 to 16.1.4
F5 Big Ip Link Controller	Version 17.1.0
F5 Big Ip Local Traffic Manager	From 13.1.0 to 13.1.5
F5 Big Ip Local Traffic Manager	From 14.1.0 to 14.1.5
F5 Big Ip Local Traffic Manager	From 15.1.0 to 15.1.10
F5 Big Ip Local Traffic Manager	From 16.1.0 to 16.1.4
F5 Big Ip Local Traffic Manager	Version 17.1.0
F5 Big Ip Next	Version 20.0.1
F5 Big Ip Next Service Proxy For Kubernetes	From 1.5.0 to 1.8.2
F5 Big Ip Policy Enforcement Manager	From 13.1.0 to 13.1.5
F5 Big Ip Policy Enforcement Manager	From 14.1.0 to 14.1.5
F5 Big Ip Policy Enforcement Manager	From 15.1.0 to 15.1.10
F5 Big Ip Policy Enforcement Manager	From 16.1.0 to 16.1.4
F5 Big Ip Policy Enforcement Manager	Version 17.1.0
F5 Big Ip Ssl Orchestrator	From 13.1.0 to 13.1.5
F5 Big Ip Ssl Orchestrator	From 14.1.0 to 14.1.5
F5 Big Ip Ssl Orchestrator	From 15.1.0 to 15.1.10
F5 Big Ip Ssl Orchestrator	From 16.1.0 to 16.1.4
F5 Big Ip Ssl Orchestrator	Version 17.1.0
F5 Big Ip Webaccelerator	From 13.1.0 to 13.1.5
F5 Big Ip Webaccelerator	From 14.1.0 to 14.1.5
F5 Big Ip Webaccelerator	From 15.1.0 to 15.1.10
F5 Big Ip Webaccelerator	From 16.1.0 to 16.1.4
F5 Big Ip Webaccelerator	Version 17.1.0
F5 Big Ip Websafe	From 13.1.0 to 13.1.5
F5 Big Ip Websafe	From 14.1.0 to 14.1.5
F5 Big Ip Websafe	From 15.1.0 to 15.1.10
F5 Big Ip Websafe	From 16.1.0 to 16.1.4
F5 Big Ip Websafe	Version 17.1.0
F5 Nginx	From 1.9.5 to 1.25.2
F5 Nginx Ingress Controller	From 2.0.0 to 2.4.2
F5 Nginx Ingress Controller	From 3.0.0 to 3.3.0
F5 Nginx Plus	From r25 to r29
F5 Nginx Plus	Version r29
F5 Nginx Plus	Version r30

Configuration N

14 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	From 10.1.0 to 10.1.13
Apache Tomcat	From 8.5.0 to 8.5.93
Apache Tomcat	From 9.0.0 to 9.0.80
Apache Tomcat	Version 11.0.0 milestone10
Apache Tomcat	Version 11.0.0 milestone11
Apache Tomcat	Version 11.0.0 milestone1
Apache Tomcat	Version 11.0.0 milestone2
Apache Tomcat	Version 11.0.0 milestone3
Apache Tomcat	Version 11.0.0 milestone4
Apache Tomcat	Version 11.0.0 milestone5
Apache Tomcat	Version 11.0.0 milestone6
Apache Tomcat	Version 11.0.0 milestone7
Apache Tomcat	Version 11.0.0 milestone8
Apache Tomcat	Version 11.0.0 milestone9

Configuration O

1 vulnerable

Vulnerable Software	Affected Versions
Apple Swiftnio Http/2	Before 1.28.0

Configuration P

4 vulnerable

Vulnerable Software	Affected Versions
Grpc Grpc	Up to 1.59.2
Grpc Grpc	Before 1.56.3
Grpc Grpc	From 1.58.0 to 1.58.3
Grpc Grpc	Version 1.57.0

Configuration Q

19 vulnerable

Vulnerable Software	Affected Versions
Microsoft .net	From 6.0.0 to 6.0.23
Microsoft .net	From 7.0.0 to 7.0.12
Microsoft Asp.net Core	From 6.0.0 to 6.0.23
Microsoft Asp.net Core	From 7.0.0 to 7.0.12
Microsoft Azure Kubernetes Service	Before 2023-10-08
Microsoft Visual Studio 2022	From 17.0 to 17.2.20
Microsoft Visual Studio 2022	From 17.4 to 17.4.12
Microsoft Visual Studio 2022	From 17.6 to 17.6.8
Microsoft Visual Studio 2022	From 17.7 to 17.7.5
Microsoft Windows 10 1607	Before 10.0.14393.6351
Microsoft Windows 10 1607	Before 10.0.14393.6351
Microsoft Windows 10 1809	Before 10.0.17763.4974
Microsoft Windows 10 21h2	Before 10.0.19044.3570
Microsoft Windows 10 22h2	Before 10.0.19045.3570
Microsoft Windows 11 21h2	Before 10.0.22000.2538
Microsoft Windows 11 22h2	Before 10.0.22621.2428
Microsoft Windows Server 2016	All versions
Microsoft Windows Server 2019	All versions
Microsoft Windows Server 2022	All versions

Configuration R

2 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 18.0.0 to 18.18.2
Nodejs Node.js	From 20.0.0 to 20.8.1

Configuration S

1 vulnerable

Vulnerable Software	Affected Versions
Microsoft Cbl Mariner	Before 2023-10-11

Configuration T

1 vulnerable

Vulnerable Software	Affected Versions
Dena H2o	Before 2023-10-10

Configuration U

1 vulnerable

Vulnerable Software	Affected Versions
Facebook Proxygen	Before 2023.10.16.00

Configuration V

3 vulnerable

Vulnerable Software	Affected Versions
Apache Apisix	Before 3.6.1
Apache Traffic Server	From 8.0.0 to 8.1.9
Apache Traffic Server	From 9.0.0 to 9.2.3

Configuration W

1 vulnerable

Vulnerable Software	Affected Versions
Amazon Opensearch Data Prepper	Before 2.5.0

Configuration X

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0
Debian Debian Linux	Version 12.0

Configuration Y

1 vulnerable

Vulnerable Software	Affected Versions
Kazu Yamamoto Http2	Before 4.2.2

Configuration Z

3 vulnerable

Vulnerable Software	Affected Versions
Istio Istio	Before 1.17.6
Istio Istio	From 1.18.0 to 1.18.3
Istio Istio	From 1.19.0 to 1.19.1

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Varnish Cache Project Varnish Cache	Before 2023-10-10

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Traefik Traefik	Before 2.10.5
Traefik Traefik	Version 3.0.0 beta1
Traefik Traefik	Version 3.0.0 beta2
Traefik Traefik	Version 3.0.0 beta3

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Projectcontour Contour	Before 2023-10-11

Configuration D

5 vulnerable

Vulnerable Software	Affected Versions
Linkerd Linkerd	From 2.12.0 to 2.12.5
Linkerd Linkerd	Version 2.13.0
Linkerd Linkerd	Version 2.13.1
Linkerd Linkerd	Version 2.14.0
Linkerd Linkerd	Version 2.14.1

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Linecorp Armeria	Before 1.26.0

Configuration F

63 vulnerable

Vulnerable Software	Affected Versions
Redhat 3scale Api Management Platform	Version 2.0
Redhat Advanced Cluster Management For Kubernetes	Version 2.0
Redhat Advanced Cluster Security	Version 3.0
Redhat Advanced Cluster Security	Version 4.0
Redhat Ansible Automation Platform	Version 2.0
Redhat Build Of Optaplanner	Version 8.0
Redhat Build Of Quarkus	All versions
Redhat Ceph Storage	Version 5.0
Redhat Cert Manager Operator For Red Hat Openshift	All versions
Redhat Certification For Red Hat Enterprise Linux	Version 8.0
Redhat Certification For Red Hat Enterprise Linux	Version 9.0
Redhat Cost Management	All versions
Redhat Cryostat	Version 2.0
Redhat Decision Manager	Version 7.0
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 9.0
Redhat Fence Agents Remediation Operator	All versions
Redhat Integration Camel For Spring Boot	All versions
Redhat Integration Camel K	All versions
Redhat Integration Service Registry	All versions
Redhat Jboss A Mq	Version 7
Redhat Jboss A Mq Streams	All versions
Redhat Jboss Core Services	All versions
Redhat Jboss Data Grid	Version 7.0.0
Redhat Jboss Enterprise Application Platform	Version 6.0.0
Redhat Jboss Enterprise Application Platform	Version 7.0.0
Redhat Jboss Fuse	Version 6.0.0
Redhat Jboss Fuse	Version 7.0.0
Redhat Logging Subsystem For Red Hat Openshift	All versions
Redhat Machine Deletion Remediation Operator	All versions
Redhat Migration Toolkit For Applications	Version 6.0
Redhat Migration Toolkit For Containers	All versions
Redhat Migration Toolkit For Virtualization	All versions
Redhat Network Observability Operator	All versions
Redhat Node Healthcheck Operator	All versions
Redhat Node Maintenance Operator	All versions
Redhat Openshift	All versions
Redhat Openshift Api For Data Protection	All versions
Redhat Openshift Container Platform	Version 4.0
Redhat Openshift Container Platform Assisted Installer	All versions
Redhat Openshift Data Science	All versions
Redhat Openshift Dev Spaces	All versions
Redhat Openshift Developer Tools And Services	All versions
Redhat Openshift Distributed Tracing	All versions
Redhat Openshift Gitops	All versions
Redhat Openshift Pipelines	All versions
Redhat Openshift Sandboxed Containers	All versions
Redhat Openshift Secondary Scheduler Operator	All versions
Redhat Openshift Serverless	All versions
Redhat Openshift Service Mesh	Version 2.0
Redhat Openshift Virtualization	Version 4
Redhat Openstack Platform	Version 16.1
Redhat Openstack Platform	Version 16.2
Redhat Openstack Platform	Version 17.1
Redhat Process Automation	Version 7.0
Redhat Quay	Version 3.0.0
Redhat Run Once Duration Override Operator	All versions
Redhat Satellite	Version 6.0
Redhat Self Node Remediation Operator	All versions
Redhat Service Interconnect	Version 1.0
Redhat Single Sign On	Version 7.0
Redhat Support For Spring Boot	All versions
Redhat Web Terminal	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Redhat Service Telemetry Framework	Version 1.5

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 8.0

Configuration H

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 37
Fedoraproject Fedora	Version 38

Configuration I

2 vulnerable

Vulnerable Software	Affected Versions
Netapp Astra Control Center	All versions
Netapp Oncommand Insight	All versions

Configuration J

1 vulnerable

Vulnerable Software	Affected Versions
Akka Http Server	Before 10.5.3

Configuration K

1 vulnerable

Vulnerable Software	Affected Versions
Konghq Kong Gateway	Before 3.4.2

Configuration L

2 vulnerable

Vulnerable Software	Affected Versions
Jenkins Jenkins	Up to 2.427
Jenkins Jenkins	Up to 2.414.2

Configuration M

1 vulnerable

Vulnerable Software	Affected Versions
Apache Solr	Before 9.4.0

Configuration N

1 vulnerable

Vulnerable Software	Affected Versions
Openresty Openresty	Before 1.21.4.3

Configuration O

30 vulnerable

Vulnerable Software	Affected Versions
Cisco Business Process Automation	Before 3.2.003.009
Cisco Connected Mobile Experiences	Before 11.1
Cisco Crosswork Data Gateway	Before 4.1.3
Cisco Crosswork Data Gateway	From 5.0.0 to 5.0.2
Cisco Crosswork Situation Manager	All versions
Cisco Crosswork Zero Touch Provisioning	Before 6.0.0
Cisco Data Center Network Manager	All versions
Cisco Enterprise Chat And Email	All versions
Cisco Expressway	Before x14.3.3
Cisco Firepower Threat Defense	Before 7.4.2
Cisco Fog Director	Before 1.22
Cisco Ios Xe	Before 17.15.1
Cisco Ios Xr	Before 7.11.2
Cisco Iot Field Network Director	Before 4.11.0
Cisco Prime Access Registrar	Before 9.3.3
Cisco Prime Cable Provisioning	Before 7.2.1
Cisco Prime Infrastructure	Before 3.10.4
Cisco Prime Network Registrar	Before 11.2
Cisco Secure Dynamic Attributes Connector	Before 2.2.0
Cisco Secure Malware Analytics	Before 2.19.2
Cisco Telepresence Video Communication Server	Before x14.3.3
Cisco Ultra Cloud Core Policy Control Function	Before 2024.01.0
Cisco Ultra Cloud Core Policy Control Function	Version 2024.01.0
Cisco Ultra Cloud Core Serving Gateway Function	Before 2024.02.0
Cisco Ultra Cloud Core Session Management Function	Before 2024.02.0
Cisco Unified Attendant Console Advanced	All versions
Cisco Unified Contact Center Domain Manager	All versions
Cisco Unified Contact Center Enterprise	All versions
Cisco Unified Contact Center Enterprise Live Data Server	Before 12.6.2
Cisco Unified Contact Center Management Portal	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Cisco Secure Web Appliance Firmware	Before 15.1.0

Running on/with	Platform Versions
Cisco Secure Web Appliance	All versions

Configuration Q

55 platform

Running on/with	Platform Versions
Cisco Nexus 3016	All versions
Cisco Nexus 3016q	All versions
Cisco Nexus 3048	All versions
Cisco Nexus 3064	All versions
Cisco Nexus 3064 32t	All versions
Cisco Nexus 3064 T	All versions
Cisco Nexus 3064 X	All versions
Cisco Nexus 3064t	All versions
Cisco Nexus 3064x	All versions
Cisco Nexus 3100	All versions
Cisco Nexus 3100 V	All versions
Cisco Nexus 3100 Z	All versions
Cisco Nexus 3100v	All versions
Cisco Nexus 31108pc V	All versions
Cisco Nexus 31108pv V	All versions
Cisco Nexus 31108tc V	All versions
Cisco Nexus 31128pq	All versions
Cisco Nexus 3132c Z	All versions
Cisco Nexus 3132q	All versions
Cisco Nexus 3132q V	All versions
Cisco Nexus 3132q X	All versions
Cisco Nexus 3132q X/3132q Xl	All versions
Cisco Nexus 3132q Xl	All versions
Cisco Nexus 3164q	All versions
Cisco Nexus 3172	All versions
Cisco Nexus 3172pq	All versions
Cisco Nexus 3172pq Xl	All versions
Cisco Nexus 3172pq/pq Xl	All versions
Cisco Nexus 3172tq	All versions
Cisco Nexus 3172tq 32t	All versions
Cisco Nexus 3172tq Xl	All versions
Cisco Nexus 3200	All versions
Cisco Nexus 3232	All versions
Cisco Nexus 3232c	All versions
Cisco Nexus 3232c	All versions
Cisco Nexus 3264c E	All versions
Cisco Nexus 3264q	All versions
Cisco Nexus 3400	All versions
Cisco Nexus 3408 S	All versions
Cisco Nexus 34180yc	All versions
Cisco Nexus 34200yc Sm	All versions
Cisco Nexus 3432d S	All versions
Cisco Nexus 3464c	All versions
Cisco Nexus 3500	All versions
Cisco Nexus 3524	All versions
Cisco Nexus 3524 X	All versions
Cisco Nexus 3524 X/xl	All versions
Cisco Nexus 3524 Xl	All versions
Cisco Nexus 3548	All versions
Cisco Nexus 3548 X	All versions
Cisco Nexus 3548 X/xl	All versions
Cisco Nexus 3548 Xl	All versions
Cisco Nexus 3600	All versions
Cisco Nexus 36180yc R	All versions
Cisco Nexus 3636c R	All versions

Configuration R

3 vulnerable · 99 platform

Vulnerable Software	Affected Versions
Cisco Nx Os	Before 10.2\(7\)
Cisco Nx Os	From 10.3\(1\) to 10.3\(5\)
Cisco Nx Os	From 10.4\(1\) to 10.4\(2\)

Running on/with	Platform Versions
Cisco Nexus 9000v	All versions
Cisco Nexus 9200	All versions
Cisco Nexus 9200yc	All versions
Cisco Nexus 92160yc X	All versions
Cisco Nexus 92160yc Switch	All versions
Cisco Nexus 9221c	All versions
Cisco Nexus 92300yc	All versions
Cisco Nexus 92300yc Switch	All versions
Cisco Nexus 92304qc	All versions
Cisco Nexus 92304qc Switch	All versions
Cisco Nexus 9232e	All versions
Cisco Nexus 92348gc X	All versions
Cisco Nexus 9236c	All versions
Cisco Nexus 9236c Switch	All versions
Cisco Nexus 9272q	All versions
Cisco Nexus 9272q Switch	All versions
Cisco Nexus 9300	All versions
Cisco Nexus 93108tc Ex	All versions
Cisco Nexus 93108tc Ex 24	All versions
Cisco Nexus 93108tc Ex Switch	All versions
Cisco Nexus 93108tc Fx	All versions
Cisco Nexus 93108tc Fx 24	All versions
Cisco Nexus 93108tc Fx3h	All versions
Cisco Nexus 93108tc Fx3p	All versions
Cisco Nexus 93120tx	All versions
Cisco Nexus 93120tx Switch	All versions
Cisco Nexus 93128	All versions
Cisco Nexus 93128tx	All versions
Cisco Nexus 93128tx Switch	All versions
Cisco Nexus 9316d Gx	All versions
Cisco Nexus 93180lc Ex	All versions
Cisco Nexus 93180lc Ex Switch	All versions
Cisco Nexus 93180tc Ex	All versions
Cisco Nexus 93180yc Ex	All versions
Cisco Nexus 93180yc Ex 24	All versions
Cisco Nexus 93180yc Ex Switch	All versions
Cisco Nexus 93180yc Fx	All versions
Cisco Nexus 93180yc Fx 24	All versions
Cisco Nexus 93180yc Fx3	All versions
Cisco Nexus 93180yc Fx3h	All versions
Cisco Nexus 93180yc Fx3s	All versions
Cisco Nexus 93216tc Fx2	All versions
Cisco Nexus 93240tc Fx2	All versions
Cisco Nexus 93240yc Fx2	All versions
Cisco Nexus 9332c	All versions
Cisco Nexus 9332d Gx2b	All versions
Cisco Nexus 9332d H2r	All versions
Cisco Nexus 9332pq	All versions
Cisco Nexus 9332pq Switch	All versions
Cisco Nexus 93360yc Fx2	All versions
Cisco Nexus 9336c Fx2	All versions
Cisco Nexus 9336c Fx2 E	All versions
Cisco Nexus 9336pq	All versions
Cisco Nexus 9336pq Aci	All versions
Cisco Nexus 9336pq Aci Spine	All versions
Cisco Nexus 9336pq Aci Spine Switch	All versions
Cisco Nexus 9348d Gx2a	All versions
Cisco Nexus 9348gc Fx3	All versions
Cisco Nexus 9348gc Fxp	All versions
Cisco Nexus 93600cd Gx	All versions
Cisco Nexus 9364c	All versions
Cisco Nexus 9364c Gx	All versions
Cisco Nexus 9364d Gx2a	All versions
Cisco Nexus 9372px	All versions
Cisco Nexus 9372px E	All versions
Cisco Nexus 9372px E Switch	All versions
Cisco Nexus 9372px Switch	All versions
Cisco Nexus 9372tx	All versions
Cisco Nexus 9372tx E	All versions
Cisco Nexus 9372tx E Switch	All versions
Cisco Nexus 9372tx Switch	All versions
Cisco Nexus 9396px	All versions
Cisco Nexus 9396px Switch	All versions
Cisco Nexus 9396tx	All versions
Cisco Nexus 9396tx Switch	All versions
Cisco Nexus 9408	All versions
Cisco Nexus 9432pq	All versions
Cisco Nexus 9500	All versions
Cisco Nexus 9500 16 Slot	All versions
Cisco Nexus 9500 4 Slot	All versions
Cisco Nexus 9500 8 Slot	All versions
Cisco Nexus 9500 Supervisor A	All versions
Cisco Nexus 9500 Supervisor A+	All versions
Cisco Nexus 9500 Supervisor B	All versions
Cisco Nexus 9500 Supervisor B+	All versions
Cisco Nexus 9500r	All versions
Cisco Nexus 9504	All versions
Cisco Nexus 9504 Switch	All versions
Cisco Nexus 9508	All versions
Cisco Nexus 9508 Switch	All versions
Cisco Nexus 9516	All versions
Cisco Nexus 9516 Switch	All versions
Cisco Nexus 9536pq	All versions
Cisco Nexus 9636pq	All versions
Cisco Nexus 9716d Gx	All versions
Cisco Nexus 9736pq	All versions
Cisco Nexus 9800	All versions
Cisco Nexus 9804	All versions
Cisco Nexus 9808	All versions

Related CWEs

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (292)

http://www.openwall.com/lists/oss-security/2023/10/10/6

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/10/7

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/13/4

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/13/9

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/18/4

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/18/8

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/19/6

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/20/8

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://access.redhat.com/security/cve/cve-2023-44487

Source: cve@mitre.org

Vendor Advisory

https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/

Source: cve@mitre.org

Press/Media CoverageThird Party Advisory

https://aws.amazon.com/security/security-bulletins/AWS-2023-011/

Source: cve@mitre.org

Third Party Advisory

https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/

Source: cve@mitre.org

Technical DescriptionVendor Advisory

https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/

Source: cve@mitre.org

Third Party AdvisoryVendor Advisory

https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/

Source: cve@mitre.org

Vendor Advisory

https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack

Source: cve@mitre.org

Press/Media CoverageThird Party Advisory

https://blog.vespa.ai/cve-2023-44487/

Source: cve@mitre.org

Vendor Advisory

https://bugzilla.proxmox.com/show_bug.cgi?id=4988

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2242803

Source: cve@mitre.org

Issue TrackingVendor Advisory

https://bugzilla.suse.com/show_bug.cgi?id=1216123

Source: cve@mitre.org

Issue TrackingVendor Advisory

https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9

Source: cve@mitre.org

Mailing ListPatchVendor Advisory

https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

Source: cve@mitre.org

Technical DescriptionVendor Advisory

https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack

Source: cve@mitre.org

Technical DescriptionVendor Advisory

https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125

Source: cve@mitre.org

Vendor Advisory

https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715

Source: cve@mitre.org

Third Party Advisory

https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve

Source: cve@mitre.org

Broken Link

https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764

Source: cve@mitre.org

Vendor Advisory

https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088

Source: cve@mitre.org

Issue TrackingPatch

https://github.com/Azure/AKS/issues/3947

Source: cve@mitre.org

Issue Tracking

https://github.com/Kong/kong/discussions/11741

Source: cve@mitre.org

Issue Tracking

https://github.com/advisories/GHSA-qppj-fm5r-hxr3

Source: cve@mitre.org

Vendor Advisory

https://github.com/advisories/GHSA-vx74-f528-fxqg

Source: cve@mitre.org

MitigationPatchVendor Advisory

https://github.com/advisories/GHSA-xpw8-rcwv-8f8p

Source: cve@mitre.org

PatchVendor Advisory

https://github.com/akka/akka-http/issues/4323

Source: cve@mitre.org

Issue Tracking

https://github.com/alibaba/tengine/issues/1872

Source: cve@mitre.org

Issue Tracking

https://github.com/apache/apisix/issues/10320

Source: cve@mitre.org

Issue Tracking

https://github.com/apache/httpd-site/pull/10

Source: cve@mitre.org

Issue Tracking

https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113

Source: cve@mitre.org

Product

https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2

Source: cve@mitre.org

ProductThird Party Advisory

https://github.com/apache/trafficserver/pull/10564

Source: cve@mitre.org

Issue TrackingPatch

https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487

Source: cve@mitre.org

Vendor Advisory

https://github.com/bcdannyboy/CVE-2023-44487

Source: cve@mitre.org

Third Party Advisory

https://github.com/caddyserver/caddy/issues/5877

Source: cve@mitre.org

Issue TrackingVendor Advisory

https://github.com/caddyserver/caddy/releases/tag/v2.7.5

Source: cve@mitre.org

Release NotesThird Party Advisory

https://github.com/dotnet/announcements/issues/277

Source: cve@mitre.org

Issue TrackingMitigationVendor Advisory

https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73

Source: cve@mitre.org

ProductRelease Notes

https://github.com/eclipse/jetty.project/issues/10679

Source: cve@mitre.org

Issue Tracking

https://github.com/envoyproxy/envoy/pull/30055

Source: cve@mitre.org

Issue TrackingPatch

https://github.com/etcd-io/etcd/issues/16740

Source: cve@mitre.org

Issue TrackingPatch

https://github.com/facebook/proxygen/pull/466

Source: cve@mitre.org

Issue TrackingPatch

https://github.com/golang/go/issues/63417

Source: cve@mitre.org

Issue Tracking

https://github.com/grpc/grpc-go/pull/6703

Source: cve@mitre.org

Issue TrackingPatch

https://github.com/grpc/grpc/releases/tag/v1.59.2

Source: cve@mitre.org

Mailing List

https://github.com/h2o/h2o/pull/3291

Source: cve@mitre.org

Issue TrackingPatch

https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf

Source: cve@mitre.org

Vendor Advisory

https://github.com/haproxy/haproxy/issues/2312

Source: cve@mitre.org

Issue Tracking

https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244

Source: cve@mitre.org

Product

https://github.com/junkurihara/rust-rpxy/issues/97

Source: cve@mitre.org

Issue Tracking

https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1

Source: cve@mitre.org

Patch

https://github.com/kazu-yamamoto/http2/issues/93

Source: cve@mitre.org

Issue Tracking

https://github.com/kubernetes/kubernetes/pull/121120

Source: cve@mitre.org

Issue TrackingPatch

https://github.com/line/armeria/pull/5232

Source: cve@mitre.org

Issue TrackingPatch

https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632

Source: cve@mitre.org

Patch

https://github.com/micrictor/http2-rst-stream

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/microsoft/CBL-Mariner/pull/6381

Source: cve@mitre.org

Issue TrackingPatch

https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61

Source: cve@mitre.org

Patch

https://github.com/nghttp2/nghttp2/pull/1961

Source: cve@mitre.org

Issue TrackingPatch

https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0

Source: cve@mitre.org

Release Notes

https://github.com/ninenines/cowboy/issues/1615

Source: cve@mitre.org

Issue Tracking

https://github.com/nodejs/node/pull/50121

Source: cve@mitre.org

Issue Tracking

https://github.com/openresty/openresty/issues/930

Source: cve@mitre.org

Issue Tracking

https://github.com/opensearch-project/data-prepper/issues/3474

Source: cve@mitre.org

Issue TrackingPatch

https://github.com/oqtane/oqtane.framework/discussions/3367

Source: cve@mitre.org

Issue Tracking

https://github.com/projectcontour/contour/pull/5826

Source: cve@mitre.org

Issue TrackingPatch

https://github.com/tempesta-tech/tempesta/issues/1986

Source: cve@mitre.org

Issue Tracking

https://github.com/varnishcache/varnish-cache/issues/3996

Source: cve@mitre.org

Issue Tracking

https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo

Source: cve@mitre.org

Mailing ListRelease NotesVendor Advisory

https://istio.io/latest/news/security/istio-security-2023-004/

Source: cve@mitre.org

Vendor Advisory

https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/

Source: cve@mitre.org

Vendor Advisory

https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q

Source: cve@mitre.org

Mailing List

https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html

Source: cve@mitre.org

Mailing List

https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html

Source: cve@mitre.org

Mailing List

https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html

Source: cve@mitre.org

Mailing List

https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html

Source: cve@mitre.org

Mailing List

https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html

Source: cve@mitre.org

Mailing List

https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/

Source: cve@mitre.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/

Source: cve@mitre.org

Mailing List

https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html

Source: cve@mitre.org

Third Party Advisory

https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/

Source: cve@mitre.org

PatchVendor Advisory

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487

Source: cve@mitre.org

MitigationPatchVendor Advisory

https://my.f5.com/manage/s/article/K000137106

Source: cve@mitre.org

Vendor Advisory

https://netty.io/news/2023/10/10/4-1-100-Final.html

Source: cve@mitre.org

Release NotesVendor Advisory

https://news.ycombinator.com/item?id=37830987

Source: cve@mitre.org

Issue Tracking

https://news.ycombinator.com/item?id=37830998

Source: cve@mitre.org

Issue TrackingPress/Media Coverage

https://news.ycombinator.com/item?id=37831062

Source: cve@mitre.org

Issue Tracking

https://news.ycombinator.com/item?id=37837043

Source: cve@mitre.org

Issue Tracking

https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/

Source: cve@mitre.org

Third Party Advisory

https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected

Source: cve@mitre.org

Third Party Advisory

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ

Source: cve@mitre.org

Vendor Advisory

https://security.gentoo.org/glsa/202311-09

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20231016-0001/

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20240426-0007/

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20240621-0006/

Source: cve@mitre.org

ExploitThird Party Advisory

https://security.netapp.com/advisory/ntap-20240621-0007/

Source: cve@mitre.org

Third Party Advisory

https://security.paloaltonetworks.com/CVE-2023-44487

Source: cve@mitre.org

Vendor Advisory

https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14

Source: cve@mitre.org

Release Notes

https://ubuntu.com/security/CVE-2023-44487

Source: cve@mitre.org

Vendor Advisory

https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/

Source: cve@mitre.org

Third Party Advisory

https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event

Source: cve@mitre.org

Press/Media CoverageThird Party Advisory

https://www.debian.org/security/2023/dsa-5521

Source: cve@mitre.org

Mailing ListVendor Advisory

https://www.debian.org/security/2023/dsa-5522

Source: cve@mitre.org

Mailing ListVendor Advisory

https://www.debian.org/security/2023/dsa-5540

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://www.debian.org/security/2023/dsa-5549

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://www.debian.org/security/2023/dsa-5558

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://www.debian.org/security/2023/dsa-5570

Source: cve@mitre.org

Third Party Advisory

https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487

Source: cve@mitre.org

Third Party AdvisoryVendor Advisory

https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/

Source: cve@mitre.org

Vendor Advisory

https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/

Source: cve@mitre.org

MitigationVendor Advisory

https://www.openwall.com/lists/oss-security/2023/10/10/6

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack

Source: cve@mitre.org

Press/Media Coverage

https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/

Source: cve@mitre.org

Press/Media CoverageThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/13/4