CVE-2023-44487

7.5 Élevée Exploitée activement

Publiée le 10/10/2023 à 16:15 · Modifiée le 11/08/2026 à 21:37 · Analysée par le NVD · Source : cve@mitre.org

Catalogue CISA KEV — HTTP/2 Rapid Reset Attack Vulnerability

Ajoutée le 10/10/2023 · Échéance de correction (agences US) : 31/10/2023

Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
3.1	7.5 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-400

Références

http://www.openwall.com/lists/oss-security/2023/10/10/6 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/10/7 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/13/4 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/13/9 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/18/4 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/18/8 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/19/6 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/20/8 Mailing ListThird Party Advisory
https://access.redhat.com/security/cve/cve-2023-44487 Vendor Advisory
https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/ Press/Media CoverageThird Party Advisory
https://aws.amazon.com/security/security-bulletins/AWS-2023-011/ Third Party Advisory
https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ Technical DescriptionVendor Advisory
https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/ Third Party AdvisoryVendor Advisory
https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/ Vendor Advisory
https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack Press/Media CoverageThird Party Advisory
https://blog.vespa.ai/cve-2023-44487/ Vendor Advisory
https://bugzilla.proxmox.com/show_bug.cgi?id=4988 Issue TrackingThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2242803 Issue TrackingVendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1216123 Issue TrackingVendor Advisory
https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 Mailing ListPatchVendor Advisory
https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/ Technical DescriptionVendor Advisory
https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack Technical DescriptionVendor Advisory
https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125 Vendor Advisory
https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715 Third Party Advisory
https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve Broken Link
https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764 Vendor Advisory
https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088 Issue TrackingPatch
https://github.com/Azure/AKS/issues/3947 Issue Tracking
https://github.com/Kong/kong/discussions/11741 Issue Tracking
https://github.com/advisories/GHSA-qppj-fm5r-hxr3 Vendor Advisory
https://github.com/advisories/GHSA-vx74-f528-fxqg MitigationPatchVendor Advisory
https://github.com/advisories/GHSA-xpw8-rcwv-8f8p PatchVendor Advisory
https://github.com/akka/akka-http/issues/4323 Issue Tracking
https://github.com/alibaba/tengine/issues/1872 Issue Tracking
https://github.com/apache/apisix/issues/10320 Issue Tracking
https://github.com/apache/httpd-site/pull/10 Issue Tracking
https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113 Product
https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2 ProductThird Party Advisory
https://github.com/apache/trafficserver/pull/10564 Issue TrackingPatch
https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487 Vendor Advisory
https://github.com/bcdannyboy/CVE-2023-44487 Third Party Advisory
https://github.com/caddyserver/caddy/issues/5877 Issue TrackingVendor Advisory
https://github.com/caddyserver/caddy/releases/tag/v2.7.5 Release NotesThird Party Advisory
https://github.com/dotnet/announcements/issues/277 Issue TrackingMitigationVendor Advisory
https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73 ProductRelease Notes
https://github.com/eclipse/jetty.project/issues/10679 Issue Tracking
https://github.com/envoyproxy/envoy/pull/30055 Issue TrackingPatch
https://github.com/etcd-io/etcd/issues/16740 Issue TrackingPatch
https://github.com/facebook/proxygen/pull/466 Issue TrackingPatch
https://github.com/golang/go/issues/63417 Issue Tracking
https://github.com/grpc/grpc-go/pull/6703 Issue TrackingPatch
https://github.com/grpc/grpc/releases/tag/v1.59.2 Mailing List
https://github.com/h2o/h2o/pull/3291 Issue TrackingPatch
https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf Vendor Advisory
https://github.com/haproxy/haproxy/issues/2312 Issue Tracking
https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244 Product
https://github.com/junkurihara/rust-rpxy/issues/97 Issue Tracking
https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1 Patch
https://github.com/kazu-yamamoto/http2/issues/93 Issue Tracking
https://github.com/kubernetes/kubernetes/pull/121120 Issue TrackingPatch
https://github.com/line/armeria/pull/5232 Issue TrackingPatch
https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632 Patch
https://github.com/micrictor/http2-rst-stream ExploitThird Party Advisory
https://github.com/microsoft/CBL-Mariner/pull/6381 Issue TrackingPatch
https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61 Patch
https://github.com/nghttp2/nghttp2/pull/1961 Issue TrackingPatch
https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0 Release Notes
https://github.com/ninenines/cowboy/issues/1615 Issue Tracking
https://github.com/nodejs/node/pull/50121 Issue Tracking
https://github.com/openresty/openresty/issues/930 Issue Tracking
https://github.com/opensearch-project/data-prepper/issues/3474 Issue TrackingPatch
https://github.com/oqtane/oqtane.framework/discussions/3367 Issue Tracking
https://github.com/projectcontour/contour/pull/5826 Issue TrackingPatch
https://github.com/tempesta-tech/tempesta/issues/1986 Issue Tracking
https://github.com/varnishcache/varnish-cache/issues/3996 Issue Tracking
https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo Mailing ListRelease NotesVendor Advisory
https://istio.io/latest/news/security/istio-security-2023-004/ Vendor Advisory
https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/ Vendor Advisory
https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q Mailing List
https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html Mailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html Mailing List
https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html Mailing List
https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html Mailing List
https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html Mailing List
https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html Mailing List
https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/ Mailing List
https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html Mailing ListThird Party Advisory
https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html Mailing ListPatchThird Party Advisory
https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html Third Party Advisory
https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/ PatchVendor Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487 MitigationPatchVendor Advisory
https://my.f5.com/manage/s/article/K000137106 Vendor Advisory
https://netty.io/news/2023/10/10/4-1-100-Final.html Release NotesVendor Advisory
https://news.ycombinator.com/item?id=37830987 Issue Tracking
https://news.ycombinator.com/item?id=37830998 Issue TrackingPress/Media Coverage
https://news.ycombinator.com/item?id=37831062 Issue Tracking
https://news.ycombinator.com/item?id=37837043 Issue Tracking
https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/ Third Party Advisory
https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected Third Party Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ Vendor Advisory
https://security.gentoo.org/glsa/202311-09 Third Party Advisory
https://security.netapp.com/advisory/ntap-20231016-0001/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20240426-0007/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0006/ ExploitThird Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0007/ Third Party Advisory
https://security.paloaltonetworks.com/CVE-2023-44487 Vendor Advisory
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14 Release Notes
https://ubuntu.com/security/CVE-2023-44487 Vendor Advisory
https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/ Third Party Advisory
https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487 Third Party AdvisoryUS Government Resource
https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event Press/Media CoverageThird Party Advisory
https://www.debian.org/security/2023/dsa-5521 Mailing ListVendor Advisory
https://www.debian.org/security/2023/dsa-5522 Mailing ListVendor Advisory
https://www.debian.org/security/2023/dsa-5540 Mailing ListThird Party Advisory
https://www.debian.org/security/2023/dsa-5549 Mailing ListThird Party Advisory
https://www.debian.org/security/2023/dsa-5558 Mailing ListThird Party Advisory
https://www.debian.org/security/2023/dsa-5570 Third Party Advisory
https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 Third Party AdvisoryVendor Advisory
https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/ Vendor Advisory
https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ MitigationVendor Advisory
https://www.openwall.com/lists/oss-security/2023/10/10/6 Mailing ListThird Party Advisory
https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack Press/Media Coverage
https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/ Press/Media CoverageThird Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/13/4 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/13/9 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/18/4 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/18/8 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/19/6 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/20/8 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2025/08/13/6 Third Party Advisory
https://access.redhat.com/security/cve/cve-2023-44487 Vendor Advisory
https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/ Press/Media CoverageThird Party Advisory
https://aws.amazon.com/security/security-bulletins/AWS-2023-011/ Third Party Advisory
https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ Technical DescriptionVendor Advisory
https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/ Third Party AdvisoryVendor Advisory
https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/ Vendor Advisory
https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack Press/Media CoverageThird Party Advisory
https://blog.vespa.ai/cve-2023-44487/ Vendor Advisory
https://bugzilla.proxmox.com/show_bug.cgi?id=4988 Issue TrackingThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2242803 Issue TrackingVendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1216123 Issue TrackingVendor Advisory
https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 Mailing ListPatchVendor Advisory
https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/ Technical DescriptionVendor Advisory
https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack Technical DescriptionVendor Advisory
https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125 Vendor Advisory
https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715 Third Party Advisory
https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve Broken Link
https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764 Vendor Advisory
https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088 Issue TrackingPatch
https://github.com/Azure/AKS/issues/3947 Issue Tracking
https://github.com/Kong/kong/discussions/11741 Issue Tracking
https://github.com/advisories/GHSA-qppj-fm5r-hxr3 Vendor Advisory
https://github.com/advisories/GHSA-vx74-f528-fxqg MitigationPatchVendor Advisory
https://github.com/advisories/GHSA-xpw8-rcwv-8f8p PatchVendor Advisory
https://github.com/akka/akka-http/issues/4323 Issue Tracking
https://github.com/alibaba/tengine/issues/1872 Issue Tracking
https://github.com/apache/apisix/issues/10320 Issue Tracking
https://github.com/apache/httpd-site/pull/10 Issue Tracking
https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113 Product
https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2 ProductThird Party Advisory
https://github.com/apache/trafficserver/pull/10564 Issue TrackingPatch
https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487 Vendor Advisory
https://github.com/bcdannyboy/CVE-2023-44487 Third Party Advisory
https://github.com/caddyserver/caddy/issues/5877 Issue TrackingVendor Advisory
https://github.com/caddyserver/caddy/releases/tag/v2.7.5 Release NotesThird Party Advisory
https://github.com/dotnet/announcements/issues/277 Issue TrackingMitigationVendor Advisory
https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73 ProductRelease Notes
https://github.com/eclipse/jetty.project/issues/10679 Issue Tracking
https://github.com/envoyproxy/envoy/pull/30055 Issue TrackingPatch
https://github.com/etcd-io/etcd/issues/16740 Issue TrackingPatch
https://github.com/facebook/proxygen/pull/466 Issue TrackingPatch
https://github.com/golang/go/issues/63417 Issue Tracking
https://github.com/grpc/grpc-go/pull/6703 Issue TrackingPatch
https://github.com/h2o/h2o/pull/3291 Issue TrackingPatch
https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf Vendor Advisory
https://github.com/haproxy/haproxy/issues/2312 Issue Tracking
https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244 Product
https://github.com/junkurihara/rust-rpxy/issues/97 Issue Tracking
https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1 Patch
https://github.com/kazu-yamamoto/http2/issues/93 Issue Tracking
https://github.com/kubernetes/kubernetes/pull/121120 Issue TrackingPatch
https://github.com/line/armeria/pull/5232 Issue TrackingPatch
https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632 Patch
https://github.com/micrictor/http2-rst-stream ExploitThird Party Advisory
https://github.com/microsoft/CBL-Mariner/pull/6381 Issue TrackingPatch
https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61 Patch
https://github.com/nghttp2/nghttp2/pull/1961 Issue TrackingPatch
https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0 Release Notes
https://github.com/ninenines/cowboy/issues/1615 Issue Tracking
https://github.com/nodejs/node/pull/50121 Issue Tracking
https://github.com/openresty/openresty/issues/930 Issue Tracking
https://github.com/opensearch-project/data-prepper/issues/3474 Issue TrackingPatch
https://github.com/oqtane/oqtane.framework/discussions/3367 Issue Tracking
https://github.com/projectcontour/contour/pull/5826 Issue TrackingPatch
https://github.com/tempesta-tech/tempesta/issues/1986 Issue Tracking
https://github.com/varnishcache/varnish-cache/issues/3996 Issue Tracking
https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo Mailing ListRelease NotesVendor Advisory
https://istio.io/latest/news/security/istio-security-2023-004/ Vendor Advisory
https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/ Vendor Advisory
https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q Mailing List
https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html Mailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html Mailing List
https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html Mailing List
https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html Mailing List
https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html Mailing List
https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html Mailing List
https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/ Mailing ListThird Party Advisory
https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html Mailing ListThird Party Advisory
https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html Mailing ListPatchThird Party Advisory
https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html Third Party Advisory
https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/ PatchVendor Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487 MitigationPatchVendor Advisory
https://my.f5.com/manage/s/article/K000137106 Vendor Advisory
https://netty.io/news/2023/10/10/4-1-100-Final.html Release NotesVendor Advisory
https://news.ycombinator.com/item?id=37830987 Issue Tracking
https://news.ycombinator.com/item?id=37830998 Issue TrackingPress/Media Coverage
https://news.ycombinator.com/item?id=37831062 Issue Tracking
https://news.ycombinator.com/item?id=37837043 Issue Tracking
https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/ Third Party Advisory
https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected Third Party Advisory
https://security.gentoo.org/glsa/202311-09 Third Party Advisory
https://security.netapp.com/advisory/ntap-20231016-0001/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20240426-0007/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0006/ ExploitThird Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0007/ Third Party Advisory
https://security.paloaltonetworks.com/CVE-2023-44487 Vendor Advisory
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14 Release Notes
https://ubuntu.com/security/CVE-2023-44487 Vendor Advisory
https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/ Third Party Advisory
https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487 Third Party AdvisoryUS Government Resource
https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event Press/Media CoverageThird Party Advisory
https://www.debian.org/security/2023/dsa-5521 Mailing ListVendor Advisory
https://www.debian.org/security/2023/dsa-5522 Mailing ListVendor Advisory
https://www.debian.org/security/2023/dsa-5540 Mailing ListThird Party Advisory
https://www.debian.org/security/2023/dsa-5549 Mailing ListThird Party Advisory
https://www.debian.org/security/2023/dsa-5558 Mailing ListThird Party Advisory
https://www.debian.org/security/2023/dsa-5570 Third Party Advisory
https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 Third Party AdvisoryVendor Advisory
https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/ Vendor Advisory
https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ MitigationVendor Advisory
https://www.openwall.com/lists/oss-security/2023/10/10/6 Mailing ListThird Party Advisory
https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack Press/Media Coverage
https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/ Press/Media CoverageThird Party Advisory
https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-082556.html Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-341067.html Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-784301.html Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-832273.html Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-915275.html Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487 US Government Resource

CVE-2023-44487

Catalogue CISA KEV — HTTP/2 Rapid Reset Attack Vulnerability

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs