CVE-2023-44487highunder attackCWE-400

CVE-2023-44487

Published · Updated

Follow this CVE+ Monitor HTTP/2+ Monitor go

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

98Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.5epss 100%
from disclosure to weaponsame day
Published on NVDOct 10
1st PoCOct 10
CISA KEVOct 10
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
41 products (112 components)
Red Hat OpenStack Platform 16.1 · Red Hat Enterprise Linux 6 · Red Hat Storage 3 · Red Hat OpenStack Platform 18.0 · Red Hat Software Collections · and others 36
workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit…
Fixed
163 products (8,109 components)
Red Hat OpenShift Container Platform 4.13 · Red Hat OpenShift Container Platform 4.15 · Red Hat OpenShift Container Platform 4.14 · Red Hat OpenShift Container Platform 4.12 · Red Hat OpenShift Container Platform 4.11 · and others 158
fix ↗
Not affected
99 products (10,453 components) — because the vulnerable code is not present in the product
Red Hat JBoss Enterprise Application Platform · Red Hat OpenShift Container Platform 4.14 · Red Hat Satellite 6.14 for RHEL 8 · Red Hat build of Quarkus 2.13.8.SP3 · Red Hat OpenShift Container Platform 4.13 · and others 94
Action required by CISAfederal deadline: 2023-10-31

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

HTTP/2 allows attackers to crash or disable web servers by sending many cancellation requests that consume server resources. This vulnerability was actively exploited against real websites in 2023.

Technical detail

HTTP/2 stream cancellation (RST_STREAM frames) can be abused to rapidly reset multiple streams, causing excessive CPU and memory consumption on servers. The attack requires network access to send crafted HTTP/2 frames and results in denial of service; affected servers experienced resource exhaustion without authentication requirements.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
n/a · n/a
public PoCs found — 54
exploitdbwww.exploit-db.com/exploits/52426unverifiedgithubgithub.com/bcdannyboy/CVE-2023-44487★ 248githubgithub.com/secengjeff/rapidresetclient★ 76githubgithub.com/imabee101/CVE-2023-44487★ 56githubgithub.com/Appsynergy-io/CVE-2023-44487★ 56githubgithub.com/studiogangster/CVE-2023-44487★ 22githubgithub.com/nxenon/cve-2023-44487★ 15githubgithub.com/threatlabindonesia/CVE-2023-44487-HTTP-2-Rapid-Reset-Exploit-PoC★ 12githubgithub.com/ndrscodes/http2-rst-stream-attacker★ 6githubgithub.com/moften/CVE-2023-44487-HTTP-2-Rapid-Reset-Attack★ 2githubgithub.com/tpirate/cve-2023-44487-POC★ 2githubgithub.com/ReToCode/golang-CVE-2023-44487★ 2githubgithub.com/tahaXafous/CVE-2023-44487-dos★ 1githubgithub.com/aulauniversal/CVE-2023-44487★ 1githubgithub.com/madhusudhan-in/CVE_2023_44487-Rapid_Reset★ 1githubgithub.com/CerberusMrXi/CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit★ 1githubgithub.com/zanks08/cve-2023-44487-demo★ 1githubgithub.com/sigridou/CVE-2023-44487-★ 0githubgithub.com/ByteHackr/CVE-2023-44487★ 0githubgithub.com/TYuan0816/cve-2023-44487★ 0githubgithub.com/ReGeLePuMa/HTTP-2-Rapid-Reset-DDos★ 0githubgithub.com/ramonzx6/rapid-reset-check★ 0githubgithub.com/Hirokiii/CVE-2023-44487★ 0githubgithub.com/sastraadiwiguna-purpleeliteteaming/DDoS-Purple-Teaming-Offensive-Multi-Vector-7-Tier-Defensive-Holistic-Blueprint-★ 0githubgithub.com/BMG-Black-Magic/CVE-2023-44487★ 0githubgithub.com/sn130hk/CVE-2023-44487★ 0githubgithub.com/madhantr0/http2-security-lab★ 0githubgithub.com/pabloec20/rapidreset★ 0githubgithub.com/TLevente20/HTTP-2-RapidReset-CVE-2023-44487-Testlab★ 0vulncheckvulncheck.com/xdb/9ae3b81b8bd9unverifiedvulncheckvulncheck.com/xdb/7e124594a82eunverifiedvulncheckvulncheck.com/xdb/12f36ea6cd3eunverifiedvulncheckvulncheck.com/xdb/95898a14699aunverifiedvulncheckvulncheck.com/xdb/2a1d7187487eunverifiedvulncheckvulncheck.com/xdb/a64a9ab88fd5unverifiedvulncheckvulncheck.com/xdb/6dd9a135b0d8unverifiedvulncheckvulncheck.com/xdb/54af2e2a4404unverifiedvulncheckvulncheck.com/xdb/0f9d4f2a05f8unverifiedvulncheckvulncheck.com/xdb/f0fe97192105unverifiedvulncheckvulncheck.com/xdb/de08f4feae4cunverifiedvulncheckvulncheck.com/xdb/1a4725458b4aunverifiedvulncheckvulncheck.com/xdb/34690740d2d3unverifiedvulncheckvulncheck.com/xdb/f5782b81dab1unverifiedvulncheckvulncheck.com/xdb/b3d01bf4f362unverifiedvulncheckvulncheck.com/xdb/c3bd71694fc8unverifiedvulncheckvulncheck.com/xdb/5331b5b1af5aunverifiedvulncheckvulncheck.com/xdb/dcaf0e10df00unverifiedvulncheckvulncheck.com/xdb/ad0b2af920fdunverifiedvulncheckvulncheck.com/xdb/b81499235b44unverifiedvulncheckvulncheck.com/xdb/8fa92d2789bdunverifiedvulncheckvulncheck.com/xdb/9fffe4fac461unverifiedvulncheckvulncheck.com/xdb/1a0aa0f9ed90unverifiedvulncheckvulncheck.com/xdb/e7e84a1490d3unverifiedvulncheckvulncheck.com/xdb/f2040c1e3da3unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.