Skip to main content

Early Access — Mondoo Vulnerability Intelligence is currently in preview.

Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

© 2026 Mondoo, Inc.

Privacy Policy Terms of Service Imprint

Vulnerability Intelligence

CVE-2023-44487

HIGH7.5

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023

Published Oct 10, 2023

Modified 2 months ago

No fix available

Details

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

References

WEBhttp://www.openwall.com/lists/oss-security/2023/10/10/6 WEBhttp://www.openwall.com/lists/oss-security/2023/10/10/7 WEBhttp://www.openwall.com/lists/oss-security/2023/10/13/4 WEBhttp://www.openwall.com/lists/oss-security/2023/10/13/9 WEBhttp://www.openwall.com/lists/oss-security/2023/10/18/4 WEBhttp://www.openwall.com/lists/oss-security/2023/10/18/8 WEBhttp://www.openwall.com/lists/oss-security/2023/10/19/6 WEBhttp://www.openwall.com/lists/oss-security/2023/10/20/8 WEBhttp://www.openwall.com/lists/oss-security/2025/08/13/6 WEBhttps://access.redhat.com/security/cve/cve-2023-44487 WEBhttps://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/WEBhttps://aws.amazon.com/security/security-bulletins/AWS-2023-011/WEBhttps://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/WEBhttps://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/WEBhttps://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/WEBhttps://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack WEBhttps://blog.vespa.ai/cve-2023-44487/WEBhttps://bugzilla.proxmox.com/show_bug.cgi?id=4988 WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=2242803 WEBhttps://bugzilla.suse.com/show_bug.cgi?id=1216123 WEBhttps://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 WEBhttps://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/WEBhttps://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack WEBhttps://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125 WEBhttps://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715 WEBhttps://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve WEBhttps://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764 WEBhttps://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088 WEBhttps://github.com/Azure/AKS/issues/3947 WEBhttps://github.com/Kong/kong/discussions/11741 WEBhttps://github.com/advisories/GHSA-qppj-fm5r-hxr3 WEBhttps://github.com/advisories/GHSA-vx74-f528-fxqg WEBhttps://github.com/advisories/GHSA-xpw8-rcwv-8f8p WEBhttps://github.com/akka/akka-http/issues/4323 WEBhttps://github.com/alibaba/tengine/issues/1872 WEBhttps://github.com/apache/apisix/issues/10320 WEBhttps://github.com/apache/httpd-site/pull/10 WEBhttps://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113 WEBhttps://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2 WEBhttps://github.com/apache/trafficserver/pull/10564 WEBhttps://github.com/arkrwn/PoC/tree/main/CVE-2023-44487 WEBhttps://github.com/bcdannyboy/CVE-2023-44487 WEBhttps://github.com/caddyserver/caddy/issues/5877 WEBhttps://github.com/caddyserver/caddy/releases/tag/v2.7.5 WEBhttps://github.com/dotnet/announcements/issues/277 WEBhttps://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73 WEBhttps://github.com/eclipse/jetty.project/issues/10679 WEBhttps://github.com/envoyproxy/envoy/pull/30055 WEBhttps://github.com/etcd-io/etcd/issues/16740 WEBhttps://github.com/facebook/proxygen/pull/466 WEBhttps://github.com/golang/go/issues/63417 WEBhttps://github.com/grpc/grpc-go/pull/6703 WEBhttps://github.com/grpc/grpc/releases/tag/v1.59.2 WEBhttps://github.com/h2o/h2o/pull/3291 WEBhttps://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf WEBhttps://github.com/haproxy/haproxy/issues/2312 WEBhttps://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244 WEBhttps://github.com/junkurihara/rust-rpxy/issues/97 WEBhttps://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1 WEBhttps://github.com/kazu-yamamoto/http2/issues/93 WEBhttps://github.com/kubernetes/kubernetes/pull/121120 WEBhttps://github.com/line/armeria/pull/5232 WEBhttps://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632 WEBhttps://github.com/micrictor/http2-rst-stream WEBhttps://github.com/microsoft/CBL-Mariner/pull/6381 WEBhttps://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61 WEBhttps://github.com/nghttp2/nghttp2/pull/1961 WEBhttps://github.com/nghttp2/nghttp2/releases/tag/v1.57.0 WEBhttps://github.com/ninenines/cowboy/issues/1615 WEBhttps://github.com/nodejs/node/pull/50121 WEBhttps://github.com/openresty/openresty/issues/930 WEBhttps://github.com/opensearch-project/data-prepper/issues/3474 WEBhttps://github.com/oqtane/oqtane.framework/discussions/3367 WEBhttps://github.com/projectcontour/contour/pull/5826 WEBhttps://github.com/tempesta-tech/tempesta/issues/1986 WEBhttps://github.com/varnishcache/varnish-cache/issues/3996 WEBhttps://groups.google.com/g/golang-announce/c/iNNxDTCjZvo WEBhttps://istio.io/latest/news/security/istio-security-2023-004/WEBhttps://linkerd.io/2023/10/12/linkerd-cve-2023-44487/WEBhttps://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q WEBhttps://lists.debian.org/debian-lts-announce/2023/10/msg00020.html WEBhttps://lists.debian.org/debian-lts-announce/2023/10/msg00023.html WEBhttps://lists.debian.org/debian-lts-announce/2023/10/msg00024.html WEBhttps://lists.debian.org/debian-lts-announce/2023/10/msg00045.html WEBhttps://lists.debian.org/debian-lts-announce/2023/10/msg00047.html WEBhttps://lists.debian.org/debian-lts-announce/2023/11/msg00001.html WEBhttps://lists.debian.org/debian-lts-announce/2023/11/msg00012.html ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/ADVISORYhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/WEBhttps://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html WEBhttps://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html WEBhttps://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html WEBhttps://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/WEBhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487 WEBhttps://my.f5.com/manage/s/article/K000137106 WEBhttps://netty.io/news/2023/10/10/4-1-100-Final.html WEBhttps://news.ycombinator.com/item?id=37830987 WEBhttps://news.ycombinator.com/item?id=37830998 WEBhttps://news.ycombinator.com/item?id=37831062 WEBhttps://news.ycombinator.com/item?id=37837043 WEBhttps://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/WEBhttps://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected WEBhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ ADVISORYhttps://security.gentoo.org/glsa/202311-09 WEBhttps://security.netapp.com/advisory/ntap-20231016-0001/WEBhttps://security.netapp.com/advisory/ntap-20240426-0007/WEBhttps://security.netapp.com/advisory/ntap-20240621-0006/WEBhttps://security.netapp.com/advisory/ntap-20240621-0007/WEBhttps://security.paloaltonetworks.com/CVE-2023-44487 WEBhttps://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14 WEBhttps://ubuntu.com/security/CVE-2023-44487 WEBhttps://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/WEBhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487 WEBhttps://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2023-44487 WEBhttps://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event ADVISORYhttps://www.debian.org/security/2023/dsa-5521 ADVISORYhttps://www.debian.org/security/2023/dsa-5522 ADVISORYhttps://www.debian.org/security/2023/dsa-5540 ADVISORYhttps://www.debian.org/security/2023/dsa-5549 ADVISORYhttps://www.debian.org/security/2023/dsa-5558 ADVISORYhttps://www.debian.org/security/2023/dsa-5570 WEBhttps://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 WEBhttps://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/WEBhttps://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/WEBhttps://www.openwall.com/lists/oss-security/2023/10/10/6 WEBhttps://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack WEBhttps://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/WEBhttps://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Ecosystems

Timeline

PublishedOct 10, 2023

ModifiedNov 4, 2025

CVE-2023-44487 | Mondoo Vulnerability Intelligence