CVE-2023-44487
published 2024-04-25CVE-2023-44487: An incomplete fix was shipped for the Rapid Reset (CVE-2023-44487/CVE-2023-39325) vulnerability for an OpenShift Containers.
PriorityP187high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2023-10-31
Exploited in the wild
EPSS
100.00%
100.0th percentile
An incomplete fix was shipped for the Rapid Reset (CVE-2023-44487/CVE-2023-39325) vulnerability for an OpenShift Containers.
Affected
354 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| akka | http_server | < 10.5.3 | 10.5.3 |
| amazon | opensearch_data_prepper | < 2.5.0 | 2.5.0 |
| apache | apisix | < 3.6.1 | 3.6.1 |
| apache | http_server | >= 2.4.17 < 2.4.58 | 2.4.58 |
| apache | httpd | — | — |
| apache | solr | < 9.4.0 | 9.4.0 |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | 10.1.0 – 10.1.13 | — |
| apache | tomcat | 8.5.0 – 8.5.93 | — |
| apache | tomcat | 9.0.0 – 9.0.80 | — |
| apache | traffic_server | >= 8.0.0 < 8.1.9 | 8.1.9 |
| apache | traffic_server | >= 9.0.0 < 9.2.3 | 9.2.3 |
| apple | swiftnio_http_2 | < 1.28.0 | 1.28.0 |
| atlassian | crowd | — | — |
| caddyserver | caddy | < 2.7.5 | 2.7.5 |
| cisco | business_process_automation | < 3.2.003.009 | 3.2.003.009 |
| cisco | connected_mobile_experiences | < 11.1 | 11.1 |
| cisco | crosswork_data_gateway | < 4.1.3 | 4.1.3 |
| cisco | crosswork_data_gateway | >= 5.0.0 < 5.0.2 | 5.0.2 |
| cisco | crosswork_zero_touch_provisioning | < 6.0.0 | 6.0.0 |
| cisco | expressway | < x14.3.3 | x14.3.3 |
| cisco | firepower_threat_defense | < 7.4.2 | 7.4.2 |
| cisco | fog_director | < 1.22 | 1.22 |
| cisco | ios_xe | < 17.15.1 | 17.15.1 |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
62519
- →HTTP/2 Rapid Reset attack is performed by rapidly sending RST_STREAM frames after opening streams, causing server-side resource exhaustion. Detect abnormal rates of RST_STREAM frames per connection. ↗
- →Monitor for HTTP/2 connections that rapidly open and cancel streams (RST_STREAM frames) at high rates — a botnet of only 20,000 machines achieved 200M+ rps using this technique. ↗
- →Attacks caused a measurable increase in HTTP 502 errors at the proxy/upstream boundary — elevated 502 rates on HTTP/2 infrastructure may indicate an active Rapid Reset attack. ↗
- →Apache Tomcat servers can be detected as vulnerable to CVE-2023-44487 via Qualys WAS QID 150732, detected based on installed version. ↗
- ·HTTP/2 Rapid Reset abuses the protocol's stream multiplexing and client-unilateral cancellation design; there is no single universal fix — mitigations are implementation-specific rate controls, not a protocol-level patch. ↗
- ·An incomplete fix was shipped for CVE-2023-44487 in OpenShift Containers (tracked separately as CVE-2023-6596); operators should verify their OpenShift patch is fully remediated. ↗
- ·Windows registry mitigations (Http2MaxClientResetsPerMinute / Http2MaxClientResetsGoaway) only apply to systems that have exposed a web server to the Internet; internal-only hosts do not require configuration. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ghsa7.5HIGH
osv7.5HIGH
vulncheck7.5HIGH
cisa7.5HIGH
vendor_apache7.5
vendor_cisco7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2
ghsa_unreviewed·2026-06-23·CVSS 7.5
CVE-2023-54365 [HIGH] CWE-400 Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2
Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability.
GHSA
Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced
ghsa·2026-06-08·CVSS 7.5
CVE-2026-47244 [HIGH] CWE-400 Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced
Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced
### Impact
DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, wher
GHSA
Eclipse Jetty affected by MadeYouReset HTTP/2 vulnerability
ghsa·2025-08-20
CVE-2025-5115 [HIGH] CWE-400 Eclipse Jetty affected by MadeYouReset HTTP/2 vulnerability
Eclipse Jetty affected by MadeYouReset HTTP/2 vulnerability
## Technical Details
Below is a technical explanation of a newly discovered vulnerability in HTTP/2, which we refer to as “MadeYouReset.”
### MadeYouReset Vulnerability Summary
The MadeYouReset DDoS vulnerability is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service.
### Mechanism
The vulnerability uses malformed HTTP/2 control frames, or malformed flow, in order to make the server reset streams created by the client (using the RST_STREAM frame).
The vulnerability could be triggered by several primitives, defined by the RFC of HTTP/2 (RFC 9113). The Primitives are:
1.
OSV
Eclipse Jetty affected by MadeYouReset HTTP/2 vulnerability
osv·2025-08-20
CVE-2025-5115 [HIGH] Eclipse Jetty affected by MadeYouReset HTTP/2 vulnerability
Eclipse Jetty affected by MadeYouReset HTTP/2 vulnerability
## Technical Details
Below is a technical explanation of a newly discovered vulnerability in HTTP/2, which we refer to as “MadeYouReset.”
### MadeYouReset Vulnerability Summary
The MadeYouReset DDoS vulnerability is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service.
### Mechanism
The vulnerability uses malformed HTTP/2 control frames, or malformed flow, in order to make the server reset streams created by the client (using the RST_STREAM frame).
The vulnerability could be triggered by several primitives, defined by the RFC of HTTP/2 (RFC 9113). The Primitives are:
1.
GHSA
Netty affected by MadeYouReset HTTP/2 DDoS vulnerability
ghsa·2025-08-13
CVE-2025-55163 [HIGH] CWE-770 Netty affected by MadeYouReset HTTP/2 DDoS vulnerability
Netty affected by MadeYouReset HTTP/2 DDoS vulnerability
Below is a technical explanation of a newly discovered vulnerability in HTTP/2, which we refer to as “MadeYouReset.”
### MadeYouReset Vulnerability Summary
The MadeYouReset DDoS vulnerability is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service.
### Mechanism
The vulnerability uses malformed HTTP/2 control frames, or malformed flow, in order to make the server reset streams created by the client (using the RST_STREAM frame).
The vulnerability could be triggered by several primitives, defined by the RFC of HTTP/2 (RFC 9113). The Primitives are:
1. WINDOW_UPDATE frame wit
OSV
Netty affected by MadeYouReset HTTP/2 DDoS vulnerability
osv·2025-08-13
CVE-2025-55163 [HIGH] Netty affected by MadeYouReset HTTP/2 DDoS vulnerability
Netty affected by MadeYouReset HTTP/2 DDoS vulnerability
Below is a technical explanation of a newly discovered vulnerability in HTTP/2, which we refer to as “MadeYouReset.”
### MadeYouReset Vulnerability Summary
The MadeYouReset DDoS vulnerability is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service.
### Mechanism
The vulnerability uses malformed HTTP/2 control frames, or malformed flow, in order to make the server reset streams created by the client (using the RST_STREAM frame).
The vulnerability could be triggered by several primitives, defined by the RFC of HTTP/2 (RFC 9113). The Primitives are:
1. WINDOW_UPDATE frame wit
GHSA
GHSA-623g-7789-x7m7: An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only unauthenticat
ghsa_unreviewed·2024-12-18·CVSS 7.5
CVE-2024-12698 [HIGH] CWE-400 GHSA-623g-7789-x7m7: An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only unauthenticat
An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only unauthenticated streams were protected, not streams created by authenticated sources.
OSV
netty vulnerabilities
osv·2024-09-05·CVSS 6.5
CVE-2023-34462 [MEDIUM] netty vulnerabilities
netty vulnerabilities
It was discovered that Netty did not properly sanitize its input
parameters. A remote attacker could possibly use this issue to cause a
crash. (CVE-2023-34462)
It was discovered that Netty incorrectly handled request cancellation. A
remote attacker could possibly use this issue to cause Netty to consume
resources, leading to a denial of service. (CVE-2023-44487)
GHSA
GHSA-5m7g-hw7h-q4qh: The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2023-39325/CVE-2023-44487, known as Rapid Reset
ghsa_unreviewed·2024-05-08·CVSS 7.5
CVE-2024-4438 [HIGH] CWE-400 GHSA-5m7g-hw7h-q4qh: The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2023-39325/CVE-2023-44487, known as Rapid Reset
The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2023-39325/CVE-2023-44487, known as Rapid Reset. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red Hat Enterprise Linux versions, meaning it should be updated at compile time instead.
OSV
nghttp2 vulnerability
osv·2024-05-07·CVSS 7.5
CVE-2019-9511 [HIGH] nghttp2 vulnerability
nghttp2 vulnerability
USN-6754-1 fixed vulnerabilities in nghttp2. This update provides the
corresponding update for Ubuntu 24.04 LTS.
Original advisory details:
It was discovered that nghttp2 incorrectly handled the HTTP/2
implementation. A remote attacker could possibly use this issue to cause
nghttp2 to consume resources, leading to a denial of service. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511,
CVE-2019-9513)
It was discovered that nghttp2 incorrectly handled request cancellation. A
remote attacker could possibly use this issue to cause nghttp2 to consume
resources, leading to a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)
It was discovered that nghttp2 could be made to process an unlimited
GHSA
GHSA-m633-wxj8-4r58: An incomplete fix was shipped for the Rapid Reset (CVE-2023-44487/CVE-2023-39325) vulnerability for an OpenShift Containers
ghsa_unreviewed·2024-04-25·CVSS 7.5
CVE-2023-6596 [HIGH] CWE-400 GHSA-m633-wxj8-4r58: An incomplete fix was shipped for the Rapid Reset (CVE-2023-44487/CVE-2023-39325) vulnerability for an OpenShift Containers
An incomplete fix was shipped for the Rapid Reset (CVE-2023-44487/CVE-2023-39325) vulnerability for an OpenShift Containers.
OSV
nghttp2 vulnerabilities
osv·2024-04-25·CVSS 7.5
CVE-2019-9511 [HIGH] nghttp2 vulnerabilities
nghttp2 vulnerabilities
It was discovered that nghttp2 incorrectly handled the HTTP/2
implementation. A remote attacker could possibly use this issue to cause
nghttp2 to consume resources, leading to a denial of service. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511,
CVE-2019-9513)
It was discovered that nghttp2 incorrectly handled request cancellation. A
remote attacker could possibly use this issue to cause nghttp2 to consume
resources, leading to a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)
It was discovered that nghttp2 could be made to process an unlimited number
of HTTP/2 CONTINUATION frames. A remote attacker could possibly use this
issue to cause nghttp2 to consume resources, leading to a d
OSV
Go vulnerabilities
osv·2024-01-11·CVSS 6.1
CVE-2023-39318 [MEDIUM] Go vulnerabilities
Go vulnerabilities
Takeshi Kaneko discovered that Go did not properly handle comments and
special tags in the script context of html/template module. An attacker
could possibly use this issue to inject Javascript code and perform a cross
site scripting attack. This issue only affected Go 1.20 in Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-39318, CVE-2023-39319)
It was discovered that Go did not properly validate the "//go:cgo_"
directives during compilation. An attacker could possibly use this issue to
inject arbitrary code during compile time. (CVE-2023-39323)
It was discovered that Go did not limit the number of simultaneously
executing handler goroutines in the net/http module. An attacker could
possibly use this issue to cause a panic resulting into a denial of se
OSV
.Net regressions
osv·2023-10-25·CVSS 6.5
CVE-2023-36799 [MEDIUM] .Net regressions
.Net regressions
USN-6438-1 fixed vulnerabilities in .Net. It was discovered that the fix
for [CVE-2023-36799](https://ubuntu.com/security/CVE-2023-36799) was incomplete. This update fixes the problem.
Original advisory details:
Kevin Jones discovered that .NET did not properly process certain
X.509 certificates. An attacker could possibly use this issue to
cause a denial of service. (CVE-2023-36799)
It was discovered that the .NET Kestrel web server did not properly
handle HTTP/2 requests. A remote attacker could possibly use this
issue to cause a denial of service. (CVE-2023-44487)
OSV
CVE-2023-45802: When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately
osv·2023-10-23·CVSS 7.5
CVE-2023-45802 [HIGH] CVE-2023-45802: When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that.
This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out.
Users are recommended to upgrade to version 2.4.58, which fixes the issue
GHSA
GHSA-m4mp-v249-x3mh: When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately
ghsa_unreviewed·2023-10-23·CVSS 7.5
CVE-2023-45802 [HIGH] CWE-400 GHSA-m4mp-v249-x3mh: When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that.
This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out.
Users are recommended to upgrade to version 2.4.58, which fixes the issue
OSV
CVE-2023-45802: When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately
osv·2023-10-23·CVSS 7.5
CVE-2023-45802 [HIGH] CVE-2023-45802: When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.4.58, which fixes the issue.
OSV
dotnet6, dotnet7 vulnerabilities
osv·2023-10-19·CVSS 6.5
CVE-2023-36799 [MEDIUM] dotnet6, dotnet7 vulnerabilities
dotnet6, dotnet7 vulnerabilities
Kevin Jones discovered that .NET did not properly process certain
X.509 certificates. An attacker could possibly use this issue to
cause a denial of service. (CVE-2023-36799)
It was discovered that the .NET Kestrel web server did not properly
handle HTTP/2 requests. A remote attacker could possibly use this
issue to cause a denial of service. (CVE-2023-44487)
GHSA
github.com/kumahq/kuma affected by CVE-2023-44487
ghsa·2023-10-17·CVSS 7.5
CVE-2023-44487 [HIGH] github.com/kumahq/kuma affected by CVE-2023-44487
github.com/kumahq/kuma affected by CVE-2023-44487
### Impact
Envoy and Go HTTP/2 protocol stack is vulnerable to the "Rapid Reset" class of exploits, which send a sequence of HEADERS frames optionally followed by RST_STREAM frames.
This can be exercised if you use the builtin gateway and receive untrusted http2 traffic.
### Patches
https://github.com/kumahq/kuma/pull/8023
https://github.com/kumahq/kuma/pull/8001
https://github.com/kumahq/kuma/pull/8034
### Workarounds
Disable http2 on the gateway listener with a MeshProxyPatch or ProxyTemplate.
### References
https://github.com/advisories/GHSA-qppj-fm5r-hxr3
https://github.com/golang/go/issues/63417
https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76
https://cloud.google.com/blog/products/identity-security/how
OSV
github.com/kumahq/kuma affected by CVE-2023-44487
osv·2023-10-17·CVSS 7.5
CVE-2023-44487 [HIGH] github.com/kumahq/kuma affected by CVE-2023-44487
github.com/kumahq/kuma affected by CVE-2023-44487
### Impact
Envoy and Go HTTP/2 protocol stack is vulnerable to the "Rapid Reset" class of exploits, which send a sequence of HEADERS frames optionally followed by RST_STREAM frames.
This can be exercised if you use the builtin gateway and receive untrusted http2 traffic.
### Patches
https://github.com/kumahq/kuma/pull/8023
https://github.com/kumahq/kuma/pull/8001
https://github.com/kumahq/kuma/pull/8034
### Workarounds
Disable http2 on the gateway listener with a MeshProxyPatch or ProxyTemplate.
### References
https://github.com/advisories/GHSA-qppj-fm5r-hxr3
https://github.com/golang/go/issues/63417
https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76
https://cloud.google.com/blog/products/identity-security/how
GHSA
Traefik vulnerable to HTTP/2 request causing denial of service
ghsa·2023-10-17·CVSS 7.5
CVE-2023-39325 [HIGH] CWE-400 Traefik vulnerable to HTTP/2 request causing denial of service
Traefik vulnerable to HTTP/2 request causing denial of service
### Impact
A vulnerability CVE-2023-39325 exists in [Go managing HTTP/2 requests](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ?pli=1), which impacts Traefik. This vulnerability could be exploited to cause a denial of service.
### References
- [CVE-2023-44487](https://www.cve.org/CVERecord?id=CVE-2023-44487)
- [CVE-2023-39325](https://www.cve.org/CVERecord?id=CVE-2023-39325)
### Patches
- https://github.com/traefik/traefik/releases/tag/v2.10.5
- https://github.com/traefik/traefik/releases/tag/v3.0.0-beta4
OSV
Traefik vulnerable to HTTP/2 request causing denial of service
osv·2023-10-17·CVSS 7.5
CVE-2023-39325 [HIGH] Traefik vulnerable to HTTP/2 request causing denial of service
Traefik vulnerable to HTTP/2 request causing denial of service
### Impact
A vulnerability CVE-2023-39325 exists in [Go managing HTTP/2 requests](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ?pli=1), which impacts Traefik. This vulnerability could be exploited to cause a denial of service.
### References
- [CVE-2023-44487](https://www.cve.org/CVERecord?id=CVE-2023-44487)
- [CVE-2023-39325](https://www.cve.org/CVERecord?id=CVE-2023-39325)
### Patches
- https://github.com/traefik/traefik/releases/tag/v2.10.5
- https://github.com/traefik/traefik/releases/tag/v3.0.0-beta4
OSV
io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack
osv·2023-10-10·CVSS 7.5
[HIGH] io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack
io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack
A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.
### Impact
This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.
### Patches
This is patched in version 4.1.100.Final.
### Workarounds
A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own `Http2FrameListener` implementation or an `ChannelInboundHandler` implementation (depending which http2 API is used).
### References
- https://www.cve.org/CVERecord?id=CVE-2023-44487
- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
- https://
GHSA
github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset
ghsa·2023-10-10·CVSS 7.5
CVE-2023-44487 [HIGH] CWE-400 github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset
github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset
### Impact
Rapidly creating and cancelling streams (HEADERS frame immediately followed by RST_STREAM) without bound cause denial of service.
See https://www.cve.org/CVERecord?id=CVE-2023-44487 for details.
### Patches
nghttp2 v1.57.0 mitigates this vulnerability by default.
### Workarounds
If upgrading to nghttp2 v1.57.0 is not possible, implement `nghttp2_on_frame_recv_callback`, and check and count RST_STREAM frames. If excessive number of RST_STREAM are received, then take action, such as dropping connection silently, or call `nghttp2_submit_goaway` and gracefully terminate the connection.
### References
The following commit mitigates this vulnerability:
- https://github.com/nghttp2/nghttp2/commit/72b4af6143681f528f1d237b21a9a7
OSV
CVE-2023-44487: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited
osv·2023-10-10·CVSS 7.5
CVE-2023-44487 [HIGH] CVE-2023-44487: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
GHSA
HTTP/2 Stream Cancellation Attack
ghsa·2023-10-10
CVE-2023-44487 [MEDIUM] CWE-400 HTTP/2 Stream Cancellation Attack
HTTP/2 Stream Cancellation Attack
## HTTP/2 Rapid reset attack
The HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.
Abuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but le
OSV
github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset
osv·2023-10-10·CVSS 7.5
CVE-2023-44487 [HIGH] github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset
github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset
### Impact
Rapidly creating and cancelling streams (HEADERS frame immediately followed by RST_STREAM) without bound cause denial of service.
See https://www.cve.org/CVERecord?id=CVE-2023-44487 for details.
### Patches
nghttp2 v1.57.0 mitigates this vulnerability by default.
### Workarounds
If upgrading to nghttp2 v1.57.0 is not possible, implement `nghttp2_on_frame_recv_callback`, and check and count RST_STREAM frames. If excessive number of RST_STREAM are received, then take action, such as dropping connection silently, or call `nghttp2_submit_goaway` and gracefully terminate the connection.
### References
The following commit mitigates this vulnerability:
- https://github.com/nghttp2/nghttp2/commit/72b4af6143681f528f1d237b21a9a7
OSV
HTTP/2 Stream Cancellation Attack
osv·2023-10-10
CVE-2023-44487 [MEDIUM] HTTP/2 Stream Cancellation Attack
HTTP/2 Stream Cancellation Attack
## HTTP/2 Rapid reset attack
The HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.
Abuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but le
GHSA
io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack
ghsa·2023-10-10·CVSS 7.5
[HIGH] CWE-400 io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack
io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack
A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.
### Impact
This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.
### Patches
This is patched in version 4.1.100.Final.
### Workarounds
A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own `Http2FrameListener` implementation or an `ChannelInboundHandler` implementation (depending which http2 API is used).
### References
- https://www.cve.org/CVERecord?id=CVE-2023-44487
- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
- https://
VulnCheck
HTTP/2 Rapid Reset Attack Vulnerability
vulncheck·2023·CVSS 7.5
CVE-2023-44487 [HIGH] CWE-400 HTTP/2 Rapid Reset Attack Vulnerability
HTTP/2 Rapid Reset Attack Vulnerability
HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).
Affected: IETF HTTP/2
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2023-Oct; https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack; https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.cve.org/CVERecord?id=CVE-2023-44487; https://www.akamai.com/blog/security/ak
Red Hat
github.com/traefik/traefik: net/http2: Traefik: Denial of Service via HTTP/2 Rapid Reset technique
vendor_redhat·2026-06-23·CVSS 7.5
CVE-2023-54365 [HIGH] CWE-770 github.com/traefik/traefik: net/http2: Traefik: Denial of Service via HTTP/2 Rapid Reset technique
github.com/traefik/traefik: net/http2: Traefik: Denial of Service via HTTP/2 Rapid Reset technique
Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability.
A flaw was found in Traefik's HTTP/2 request handling. A remote attacker can exploit this vulnerability by rapidly creating and canceling HTTP/2 streams. This can exhaust server resources, leading to a denial of service (DoS) and making the service unavailable to legitimate users. This issue is inherited from the Go standard librar
Red Hat
netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams
vendor_redhat·2026-06-12·CVSS 7.5
CVE-2026-47244 [HIGH] CWE-770 netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams
netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connectio
CISA ICS
Schneider Electric EcoStruxure Power Operation (Update A)
cisa_ics·2026-02-26·CVSS 9.8
[CRITICAL] Schneider Electric EcoStruxure Power Operation (Update A)
ICS Advisory
##
Schneider Electric EcoStruxure Power Operation (Update A)
Last RevisedFebruary 26, 2026
Alert CodeICSA-25-203-04
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
Successful exploitation of these vulnerabilities could result in the loss of system functionality or unauthorized access to system functions.
The following versions of Schneider Electric EcoStruxure Power Operation (Update A) are affected:
- EcoStruxure Power Operation (EPO) 2022 <=CU6 (CVE-2023-50447, CVE-2024-28219, CVE-2022-45198, CVE-2023-5217, CVE-2023-35945, CVE-2023-44487)
- EcoStruxure Power Operation (EPO) 2024 <=CU1 (CVE-2023-50447, CVE-2024-28219, CVE-2022-45198, CVE-2023-5217, CVE-2023-35945, CVE-2023-44487)
CVS
Ubuntu
H2O vulnerability
vendor_ubuntu·2025-11-26
CVE-2023-44487 H2O vulnerability
Title: H2O vulnerability
Summary: H2O could be made to crash if it received specially crafted network traffic.
It was discovered that H2O exhibited poor server resource management in its
HTTP/2 protocol. An attacker could possibly use this issue to cause H2O to
crash, resulting in a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
CISA ICS
Siemens SIMATIC S7-1500 CPU Family
cisa_ics·2025-06-12
Siemens SIMATIC S7-1500 CPU Family
ICS Advisory
##
Siemens SIMATIC S7-1500 CPU Family
Release DateJune 12, 2025
Alert CodeICSA-25-162-05
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.7
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC S7-1500 CPU family
- Vulnerabilities: Missing Encryption of Sensitive Data, Out-of-bounds Read, Use After Free, Stack-
Ubuntu
H2O vulnerability
vendor_ubuntu·2025-04-30
CVE-2023-44487 H2O vulnerability
Title: H2O vulnerability
Summary: H2O could be made to crash if it received specially crafted network
traffic.
USN-7469-1 fixed a vulnerability in Apache Traffic Server. This update
provides the corresponding updates for H2O.
Original advisory details:
It was discovered that Apache Traffic Server exhibited poor server
resource management in its HTTP/2 protocol. An attacker could possibly
use this issue to cause Apache Traffic Server to crash, resulting in
a denial of service.
Instructions: After a standard system update you need to restart H2O to make all the
necessary changes.
Ubuntu
Node.js vulnerability
vendor_ubuntu·2025-04-29
CVE-2023-44487 Node.js vulnerability
Title: Node.js vulnerability
Summary: Node.js could be made to crash if it received specially crafted network
traffic.
USN-7469-1 fixed a vulnerability in Apache Traffic Server. This update
provides the corresponding updates for Node.js.
Original advisory details:
It was discovered that Apache Traffic Server exhibited poor server
resource management in its HTTP/2 protocol. An attacker could possibly
use this issue to cause Apache Traffic Server to crash, resulting in
a denial of service.
Instructions: After a standard system update you need to restart Node.js to make all
the necessary changes.
Ubuntu
Apache Traffic Server vulnerability
vendor_ubuntu·2025-04-28
CVE-2023-44487 Apache Traffic Server vulnerability
Title: Apache Traffic Server vulnerability
Summary: Apache Traffic Server could be made to crash if it received specially
crafted network traffic.
It was discovered that Apache Traffic Server exhibited poor server
resource management in its HTTP/2 protocol. An attacker could possibly
use this issue to cause Apache Traffic Server to crash, resulting in
a denial of service.
Instructions: After a standard system update you need to restart Apache Traffic Server
to make all the necessary changes.
Ubuntu
Apache Tomcat vulnerability
vendor_ubuntu·2025-04-28
CVE-2023-44487 Apache Tomcat vulnerability
Title: Apache Tomcat vulnerability
Summary: Apache Tomcat could be made to crash if it received specially crafted
network traffic.
USN-7469-1 fixed a vulnerability in Apache Traffic Server. This
update provides the corresponding updates for Apache Tomcat.
Original advisory details:
It was discovered that Apache Traffic Server exhibited poor server
resource management in its HTTP/2 protocol. An attacker could possibly
use this issue to cause Apache Traffic Server to crash, resulting in
a denial of service.
Instructions: After a standard system update you need to restart Apache Tomcat to
make all the necessary changes.
Ubuntu
Tomcat vulnerability
vendor_ubuntu·2025-04-07
CVE-2023-44487 Tomcat vulnerability
Title: Tomcat vulnerability
Summary: Tomcat could be made to consume resources if it received specially crafted
network traffic.
It was discovered that Tomcat incorrectly handled request cancellation. A
remote attacker could possibly use this issue to cause tomcat9 to consume
resources, leading to a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
ose-olm-catalogd-container: incomplete fix for rapid reset (CVE-2023-39325/CVE-2023-44487)
vendor_redhat·2024-12-16·CVSS 7.5
CVE-2024-12698 [HIGH] CWE-400 ose-olm-catalogd-container: incomplete fix for rapid reset (CVE-2023-39325/CVE-2023-44487)
ose-olm-catalogd-container: incomplete fix for rapid reset (CVE-2023-39325/CVE-2023-44487)
An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only unauthenticated streams were protected, not streams created by authenticated sources.
An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only unauthenticated streams were protected, not streams created by authenticated sources.
Mitigation: Red Hat Product Security does not have any mitigation recommendations at this time. Please update as soon as possible.
CISA ICS
Siemens SINEC INS
cisa_ics·2024-11-14
Siemens SINEC INS
ICS Advisory
##
Siemens SINEC INS
Release DateNovember 14, 2024
Alert CodeICSA-24-319-08
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.9
- ATTENTION: Exploitable remotely/low attack complexity/public exploits are available/known public exploitation
- Vendor: Siemens
- Equipment: SINEC INS
- Vulnerabilities: Improper Authentication, Out-of-bounds Write, Ineffici
Palo Alto
PAN-SA-2024-0013 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-11-01·CVSS 9.8
CVE-2017-12424 [CRITICAL] PAN-SA-2024-0013 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0013 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2017-12424, CVE-2021-3114, CVE-2021-31525, CVE-2021-33195, CVE-2021-33197, CVE-2021-33198, CVE-2021-34558, CVE-2021-36221, CVE-2021-4034, CVE-2021-44716, CVE-2021-44717, CVE-2022-1664, CVE-2022-1705, CVE-2022-23772, CVE-2022-24675, CVE-2022-24921, CVE-2022-28327, CVE-2022-2880, CVE-2022-29526, CVE-2022-30629, CVE-2022-30631, CVE-2022-30632, CVE-2022-32148, CVE-2022-32189, CVE-2022-41715, CVE-2022-41717, CVE-2022-41724, CVE-2022-41725, CVE-2023-24534, CVE-2023-24536, CVE-2023-24539, CVE-2023-29406, CVE-2023-29409, CVE-2023-39
Oracle
Oracle Oracle Blockchain Platform Risk Matrix: Blockchain Cloud Service Console (Netty) — CVE-2023-44487
vendor_oracle·2024-10-15·CVSS 7.5
CVE-2023-44487 [HIGH] Oracle Oracle Blockchain Platform Risk Matrix: Blockchain Cloud Service Console (Netty) — CVE-2023-44487
Oracle Oracle Blockchain Platform Risk Matrix: Blockchain Cloud Service Console (Netty) vulnerability
CVE: CVE-2023-44487
CVSS: 7.5
Protocol: HTTP/2
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2024 (OCT 2024)
Ubuntu
HAProxy vulnerability
vendor_ubuntu·2024-10-14
CVE-2023-44487 HAProxy vulnerability
Title: HAProxy vulnerability
Summary: HAProxy could be made to crash if it received
specially crafted network traffic.
It was discovered that HAProxy did not properly limit the creation of new
HTTP/2 streams. A remote attacker could possibly use this issue to cause
HAProxy to consume excessive resources, leading to a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Netty vulnerabilities
vendor_ubuntu·2024-09-05·CVSS 6.5
CVE-2023-34462 [MEDIUM] Netty vulnerabilities
Title: Netty vulnerabilities
Summary: Several security issues were fixed in Netty.
It was discovered that Netty did not properly sanitize its input
parameters. A remote attacker could possibly use this issue to cause a
crash. (CVE-2023-34462)
It was discovered that Netty incorrectly handled request cancellation. A
remote attacker could possibly use this issue to cause Netty to consume
resources, leading to a denial of service. (CVE-2023-44487)
Instructions: In general, a standard system update will make all the necessary changes.
CISA ICS
Siemens SINEC NMS
cisa_ics·2024-08-15·CVSS 7.0
[HIGH] Siemens SINEC NMS
ICS Advisory
##
Siemens SINEC NMS
Release DateAugust 15, 2024
Alert CodeICSA-24-228-06
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 9.4
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC NMS
- Vulnerabilities: Use After Free, Improper Input Validation, Deserialization of Untrusted Data, Improper Restriction of Operations
Oracle
Oracle Oracle Communications Applications Risk Matrix: Installation (Nghttp2) — CVE-2023-44487
vendor_oracle·2024-07-15·CVSS 7.5
CVE-2023-44487 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Installation (Nghttp2) — CVE-2023-44487
Oracle Oracle Communications Applications Risk Matrix: Installation (Nghttp2) vulnerability
CVE: CVE-2023-44487
CVSS: 7.5
Protocol: HTTP/2
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2024 (JUL 2024)
CISA ICS
Siemens ST7 ScadaConnect
cisa_ics·2024-06-13·CVSS 7.5
[HIGH] Siemens ST7 ScadaConnect
ICS Advisory
##
Siemens ST7 ScadaConnect
Release DateJune 13, 2024
Alert CodeICSA-24-165-04
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.2
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: ST7 ScadaConnect
- Vulnerabilities: Integer Overflow or Wraparound, Double Free, Improper Certificate Validation, Inefficient Regular Ex
Ubuntu
nghttp2 vulnerability
vendor_ubuntu·2024-05-07·CVSS 7.5
CVE-2024-28182 [HIGH] nghttp2 vulnerability
Title: nghttp2 vulnerability
Summary: Several security issues were fixed in nghttp2.
USN-6754-1 fixed vulnerabilities in nghttp2. This update provides the
corresponding update for Ubuntu 24.04 LTS.
Original advisory details:
It was discovered that nghttp2 incorrectly handled the HTTP/2
implementation. A remote attacker could possibly use this issue to cause
nghttp2 to consume resources, leading to a denial of service. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511,
CVE-2019-9513)
It was discovered that nghttp2 incorrectly handled request cancellation. A
remote attacker could possibly use this issue to cause nghttp2 to consume
resources, leading to a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)
It w
Red Hat
etcd: Incomplete fix for CVE-2023-39325/CVE-2023-44487 in OpenStack Platform
vendor_redhat·2024-05-06·CVSS 7.5
CVE-2024-4438 [HIGH] CWE-400 etcd: Incomplete fix for CVE-2023-39325/CVE-2023-44487 in OpenStack Platform
etcd: Incomplete fix for CVE-2023-39325/CVE-2023-44487 in OpenStack Platform
The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2023-39325/CVE-2023-44487, known as Rapid Reset. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red Hat Enterprise Linux versions, meaning it should be updated at compile time instead.
The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2023-39325/CVE-2023-44487, known as Rapid Reset. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red Hat Enterprise Linux versions, meaning it shou
Ubuntu
nghttp2 vulnerabilities
vendor_ubuntu·2024-04-25·CVSS 7.5
CVE-2024-28182 [HIGH] nghttp2 vulnerabilities
Title: nghttp2 vulnerabilities
Summary: Several security issues were fixed in nghttp2.
It was discovered that nghttp2 incorrectly handled the HTTP/2
implementation. A remote attacker could possibly use this issue to cause
nghttp2 to consume resources, leading to a denial of service. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511,
CVE-2019-9513)
It was discovered that nghttp2 incorrectly handled request cancellation. A
remote attacker could possibly use this issue to cause nghttp2 to consume
resources, leading to a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)
It was discovered that nghttp2 could be made to process an unlimited number
of HTTP/2 CONTINUATION frames. A remote attacker could possibly use
Oracle
Oracle Oracle Communications Applications Risk Matrix: Cloud Native Deployment (Netty) — CVE-2023-44487
vendor_oracle·2024-04-15·CVSS 7.5
CVE-2023-44487 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Cloud Native Deployment (Netty) — CVE-2023-44487
Oracle Oracle Communications Applications Risk Matrix: Cloud Native Deployment (Netty) vulnerability
CVE: CVE-2023-44487
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2024 (APR 2024)
CISA ICS
Siemens RUGGEDCOM APE1808
cisa_ics·2024-03-14
Siemens RUGGEDCOM APE1808
ICS Advisory
##
Siemens RUGGEDCOM APE1808
Release DateMarch 14, 2024
Alert CodeICSA-24-074-05
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.7
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: RUGGEDCOM APE1808
- Vulnerabilities: Heap-based Buffer Overflow, External Control of File Name or Path, Improper Privilege Management, Uncontrolled Resource Consumption, Improper Certificate Validation, Out-of-bounds Write,
Oracle
Oracle Oracle Commerce Risk Matrix: Workbench (Netty) — CVE-2023-44487
vendor_oracle·2024-01-15·CVSS 7.5
CVE-2023-44487 [HIGH] Oracle Oracle Commerce Risk Matrix: Workbench (Netty) — CVE-2023-44487
Oracle Oracle Commerce Risk Matrix: Workbench (Netty) vulnerability
CVE: CVE-2023-44487
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2024 (JAN 2024)
Ubuntu
Go vulnerabilities
vendor_ubuntu·2024-01-11·CVSS 6.1
CVE-2023-39326 [MEDIUM] Go vulnerabilities
Title: Go vulnerabilities
Summary: Several security issues were fixed in Go.
Takeshi Kaneko discovered that Go did not properly handle comments and
special tags in the script context of html/template module. An attacker
could possibly use this issue to inject Javascript code and perform a cross
site scripting attack. This issue only affected Go 1.20 in Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-39318, CVE-2023-39319)
It was discovered that Go did not properly validate the "//go:cgo_"
directives during compilation. An attacker could possibly use this issue to
inject arbitrary code during compile time. (CVE-2023-39323)
It was discovered that Go did not limit the number of simultaneously
executing handler goroutines in the net/http module. An attacker could
possibly us
Red Hat
openshift: incomplete fix for Rapid Reset (CVE-2023-44487/CVE-2023-39325)
vendor_redhat·2024-01-04·CVSS 7.5
CVE-2023-6596 [HIGH] CWE-400 openshift: incomplete fix for Rapid Reset (CVE-2023-44487/CVE-2023-39325)
openshift: incomplete fix for Rapid Reset (CVE-2023-44487/CVE-2023-39325)
An incomplete fix was shipped for the Rapid Reset (CVE-2023-44487/CVE-2023-39325) vulnerability for an OpenShift Containers.
An incomplete fix was shipped for the Rapid Reset (CVE-2023-44487/CVE-2023-39325) vulnerability for an OpenShift Containers.
Package: openshift4/ose-olm-rukpak-rhel8 (Red Hat OpenShift Container Platform 4) - Not affected
CISA ICS
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
cisa_ics·2023-12-14
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
ICS Advisory
##
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
Release DateDecember 14, 2023
Alert CodeICSA-23-348-10
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
- Vulnerabilities: Improper Restriction of XML External Entity Reference, Time-of-check Time-of-use (TOCTOU) Race Condition, Command Injection, Miss
Atlassian
CVE-2023-44487: DoS (Denial of Service) org.apache.tomcat:tomcat-coyote Vulnerability in Crowd Data Center and Server
vendor_atlassian·2023-12-12·CVSS 7.5
CVE-2023-44487 [HIGH] CVE-2023-44487: DoS (Denial of Service) org.apache.tomcat:tomcat-coyote Vulnerability in Crowd Data Center and Server
CVE-2023-44487: DoS (Denial of Service) org.apache.tomcat:tomcat-coyote Vulnerability in Crowd Data Center and Server
DoS (Denial of Service) org.apache.tomcat:tomcat-coyote Vulnerability in Crowd Data Center and Server
CVE: CVE-2023-44487
Severity: HIGH
Affected products: Crowd
Ubuntu
nghttp2 vulnerability
vendor_ubuntu·2023-11-22
CVE-2023-44487 nghttp2 vulnerability
Title: nghttp2 vulnerability
Summary: nghttp2 could be made to consume resources if it received specially crafted
network traffic.
It was discovered that nghttp2 incorrectly handled request cancellation. A
remote attacker could possibly use this issue to cause nghttp2 to consume
resources, leading to a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
.Net regressions
vendor_ubuntu·2023-10-25·CVSS 6.5
CVE-2023-36799 [MEDIUM] .Net regressions
Title: .Net regressions
Summary: An incomplete fix was discovered in .Net.
USN-6438-1 fixed vulnerabilities in .Net. It was discovered that the fix
for [CVE-2023-36799](https://ubuntu.com/security/CVE-2023-36799) was incomplete. This update fixes the problem.
Original advisory details:
Kevin Jones discovered that .NET did not properly process certain
X.509 certificates. An attacker could possibly use this issue to
cause a denial of service. (CVE-2023-36799)
It was discovered that the .NET Kestrel web server did not properly
handle HTTP/2 requests. A remote attacker could possibly use this
issue to cause a denial of service. (CVE-2023-44487)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
.NET vulnerability
vendor_ubuntu·2023-10-19
CVE-2023-44487 .NET vulnerability
Title: .NET vulnerability
Summary: .NET could be made to crash if it received specially crafted network
traffic.
USN-6427-1 fixed a vulnerability in .NET. This update
provides the corresponding update for .NET 8.
Original advisory details:
It was discovered that the .NET Kestrel web server did not properly handle
HTTP/2 requests. A remote attacker could possibly use this issue to cause a
denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
.NET vulnerabilities
vendor_ubuntu·2023-10-19·CVSS 6.5
CVE-2023-36799 [MEDIUM] .NET vulnerabilities
Title: .NET vulnerabilities
Summary: Several security issues were fixed in dotnet6, dotnet7.
Kevin Jones discovered that .NET did not properly process certain
X.509 certificates. An attacker could possibly use this issue to
cause a denial of service. (CVE-2023-36799)
It was discovered that the .NET Kestrel web server did not properly
handle HTTP/2 requests. A remote attacker could possibly use this
issue to cause a denial of service. (CVE-2023-44487)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487)
vendor_redhat·2023-10-19·CVSS 7.5
CVE-2023-45802 [HIGH] CWE-400 mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487)
mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487)
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that.
This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out
Jenkins
Jenkins Security Advisory 2023-10-18
vendor_jenkins·2023-10-18·CVSS 7.5
CVE-2023-36478 [HIGH] Jenkins Security Advisory 2023-10-18
Title: Jenkins Security Advisory 2023-10-18
Jenkins Security Advisory 2023-10-18
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Jenkins (core)
Descriptions
HTTP/2 denial of service vulnerabilities in bundled Jetty
SECURITY-3291
/
CVE-2023-36478, CVE-2023-44487
Severity (CVSS):
High
Description:
Jenkins b
Cisco
HTTP/2 Rapid Reset Attack Affecting Cisco Products: October 2023
vendor_cisco·2023-10-16·CVSS 7.5
CVE-2023-44487 [HIGH] CWE-400 HTTP/2 Rapid Reset Attack Affecting Cisco Products: October 2023
HTTP/2 Rapid Reset Attack Affecting Cisco Products: October 2023
On October 10, 2023, the following HTTP/2 protocol-level weakness, which enables a novel distributed denial of service (DDoS) attack technique, was disclosed:
CVE-2023-44487: HTTP/2 Rapid Reset
For a description of this vulnerability, see the following publications:
How it works: The novel HTTP/2 'Rapid Reset' DDoS attack (Google)
HTTP/2 Zero-Day vulnerability results in record-breaking DDoS attacks (Cloudflare)
CVE-2023-44487 - HTTP/2 Rapid Reset Attack (AWS)
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ
Palo Alto
Impact of Rapid Reset and HTTP/2 DoS Vulnerabilities (CVE-2023-44487, CVE-2023-35945)
vendor_paloalto·2023-10-11·CVSS 7.5
CVE-2023-44487 [HIGH] CWE-400 Impact of Rapid Reset and HTTP/2 DoS Vulnerabilities (CVE-2023-44487, CVE-2023-35945)
Impact of Rapid Reset and HTTP/2 DoS Vulnerabilities (CVE-2023-44487, CVE-2023-35945)
The Palo Alto Networks Product Security Assurance team is evaluating the recently disclosed denial-of-service (DoS) vulnerabilities in the HTTP/2 protocol including Rapid Reset (CVE-2023-44487) and CVE-2023-35945.
If HTTP/2 inspection is enabled in PAN-OS, an ongoing distributed denial-of-service (DDoS) attack in inspected traffic will contribute towards the session capacity limit of the firewall. This can result in the intermittent availability of new firewall sessions and is consistent in impact with other volumetric DDoS attacks. Availability of new firewall sessions will recover naturally once the DDoS attack stops. Customers who have enabled Threat prevention ID 40152 (Applications and Threats cont
Microsoft
MITRE: CVE-2023-44487 HTTP/2 Rapid Reset Attack
vendor_msrc·2023-10-10·CVSS 7.5
CVE-2023-44487 [HIGH] CWE-400 MITRE: CVE-2023-44487 HTTP/2 Rapid Reset Attack
MITRE: CVE-2023-44487 HTTP/2 Rapid Reset Attack
HTTP/2: HTTP/2
MITRE Corporation: MITRE Corporation
Customer Action Required: Yes
Impact: Denial of Service
Exploit Status: Publicly Disclosed:No;Exploited:Yes;Latest Software Release:Exploitation Detected;DOS:N/A
Reference: https://dotnet.microsoft.com/download/dotnet/6.0
Reference: https://support.microsoft.com/help/5032874
Remediation: Release Notes
Reference: https://github.com/dotnet/aspnetcore/issues/51264
Reference: https://dotnet.microsoft.com/en-us/download/dotnet/7.0
Reference: https://support.microsoft.com/help/5032875
Reference: https://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.2
Reference: https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes
Reference: https://my.visualstudio
Ubuntu
.NET vulnerability
vendor_ubuntu·2023-10-10
CVE-2023-44487 .NET vulnerability
Title: .NET vulnerability
Summary: .NET could be made to crash if it received specially crafted network
traffic.
It was discovered that the .NET Kestrel web server did not properly handle
HTTP/2 requests. A remote attacker could possibly use this issue to cause a
denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
CISA
HTTP/2 Rapid Reset Attack Vulnerability
cisa·2023-10-10·CVSS 7.5
CVE-2023-44487 [HIGH] CWE-400 HTTP/2 Rapid Reset Attack Vulnerability
Vulnerability: HTTP/2 Rapid Reset Attack Vulnerability
Affected: IETF HTTP/2
HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: This vulnerability affects a common open-source component, third-party library, or protocol used by different products. For more information, please see: HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 | CISA: https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487; https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/; https://nvd.nist.gov/vuln/detail/
Red Hat
golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)
vendor_redhat·2023-10-10·CVSS 7.5
CVE-2023-39325 [HIGH] CWE-400 golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)
golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too larg
Red Hat
HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
vendor_redhat·2023-10-10·CVSS 7.5
CVE-2023-44487 [HIGH] CWE-400 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as 'Important' as the U
Debian
CVE-2023-45802: apache2 - When a HTTP/2 stream was reset (RST frame) by a client, there was a time window ...
vendor_debian·2023·CVSS 7.5
CVE-2023-45802 [HIGH] CVE-2023-45802: apache2 - When a HTTP/2 stream was reset (RST frame) by a client, there was a time window ...
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.4.58, which fixes the issue.
Debian
CVE-2023-44487: dnsdist - The HTTP/2 protocol allows a denial of service (server resource consumption) bec...
vendor_debian·2023·CVSS 7.5
CVE-2023-44487 [HIGH] CVE-2023-44487: dnsdist - The HTTP/2 protocol allows a denial of service (server resource consumption) bec...
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 1.8.2-2)
sid: resolved (fixed in 1.8.2-2)
trixie: resolved (fixed in 1.8.2-2)
Cisco
HTTP/2 Rapid Reset Attack Affecting Cisco Products: October 2023
vendor_cisco·CVSS 3.1
CVE-2023-44487 HTTP/2 Rapid Reset Attack Affecting Cisco Products: October 2023
CVE-2023-44487: HTTP/2 Rapid Reset Attack Affecting Cisco Products: October 2023
On October 10, 2023, the following HTTP/2 protocol-level weakness, which enables a novel distributed denial of service (DDoS) attack technique, was disclosed: CVE-2023-44487: HTTP/2 Rapid Reset For a description of this vulnerability, see the following publications: How it works: The novel HTTP/2 'Rapid Reset' DDoS attack (Google) HTTP/2 Zero-Day vulnerability results in record-breaking DDoS attacks (Cloudflare) CVE-2023-44487 - HTTP/2 Rapid Reset Attack (AWS) This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ
CVSS: 3.1
CWE: CWE-400, CWE-400
Bug IDs: CSCwi12388, CSCwh89890, CSCwh88721, CSCwh88595, CSCwh88
Apache
Apache tomcat: CVE-2023-44487
vendor_apache·CVSS 7.5
CVE-2023-44487 [HIGH] Apache tomcat: CVE-2023-44487
Apache tomcat: CVE-2023-44487
Tomcat's HTTP/2 implementation was vulnerable to the rapid reset attack. The denial of service typically manifested as an OutOfMemoryError . This was fixed with commit 944332bb . This issue was reported to the Tomcat Security Team on 14 September 2023. The issue was made public on 10 October 2023. Affects: 8.5.0 to 8.5.93 Important: Information Disclosure
Severity: high
Apache
Apache httpd: CVE-2023-45802
vendor_apache·CVSS 7.5
CVE-2023-45802 Apache httpd: CVE-2023-45802
Apache httpd: CVE-2023-45802
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.
No detection rules found.
Tenable
CVE-2024-21762: Critical Fortinet FortiOS Out-of-Bound Write SSL VPN Vulnerability
blogs_tenable·2024-02-09·CVSS 9.8
[CRITICAL] CVE-2024-21762: Critical Fortinet FortiOS Out-of-Bound Write SSL VPN Vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
New Fortinet RCE flaw in SSL VPN likely exploited in attacks
blogs_bleepingcomputer·2024-02-08·CVSS 7.5
CVE-2024-21762 [HIGH] New Fortinet RCE flaw in SSL VPN likely exploited in attacks
## New Fortinet RCE flaw in SSL VPN likely exploited in attacks
## Lawrence Abrams
Fortinet is warning that a new critical remote code execution vulnerability in FortiOS SSL VPN is potentially being exploited in attacks.
The flaw (tracked as CVE-2024-21762 / FG-IR-24-015 ) received a 9.6 severity rating and is an out-of-bounds write vulnerability in FortiOS that allows unauthenticated attackers to gain remote code execution (RCE) via maliciously crafted requests.
To patch the bug, Fortinet recommends upgrading to one of the latest version based on this table:
FortiOS 7.6
Not affected
Not Applicable
FortiOS 7.4
7.4.0 through 7.4.2
Upgrade to 7.4.3 or above
FortiOS 7.2
7.2.0 through 7.2.6
Upgrade to 7.2.7 or above
FortiOS 7.0
7.0.0 through 7.0.13
Upgrade to 7.0.14 or above
F
Talos
Year in Malware 2023: Recapping the major cybersecurity stories of the past year
blogs_talos·2023-12-19
Year in Malware 2023: Recapping the major cybersecurity stories of the past year
## Year in Malware 2023: Recapping the major cybersecurity stories of the past year
If there is anything the cybersecurity world learned in 2023, it’s that you can never count any bad guy out.
Botnets kept coming back from the dead, ransomware actors found new ways to make money through data theft extortion and threat actors and malware who have been around for more than a decade find ways to stay relevant.
Since it seems like there's a new security threat every day making headlines, we like to take a step back at the end of every year to look back at the top stories in cybersecurity that Talos covered this year, including new research from Talos and the stories that were most interesting to readers.
After Microsoft blocked macros by default in Office documents, attackers needed to fin
Talos
Year in Malware 2023: Recapping the major cybersecurity stories of the past year
blogs_talos·2023-12-19
Year in Malware 2023: Recapping the major cybersecurity stories of the past year
If there is anything the cybersecurity world learned in 2023, it’s that you can never count any bad guy out.
Botnets kept coming back from the dead, ransomware actors found new ways to make money through data theft extortion and threat actors and malware who have been around for more than a decade find ways to stay relevant.
Since it seems like there's a new security threat every day making headlines, we like to take a step back at the end of every year to look back at the top stories in cybersecurity that Talos covered this year, including new research from Talos and the stories that were most interesting to readers.
- After Microsoft blocked macros by default in Office documents, attackers needed to find a new file format for their lure documents that could execute malware or maliciou
Tenable
Microsoft Patch Tuesday 2023 Year in Review
blogs_tenable·2023-12-12
Microsoft Patch Tuesday 2023 Year in Review
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Wiz
Crying Out Cloud - November Newsletter | Wiz
blogs_wiz·2023-11-01·CVSS 9.8
CVE-2023-42115 [CRITICAL] Crying Out Cloud - November Newsletter | Wiz
The past month has brought a series of vulnerabilities and security incidents that have left users affected. Amidst the noise, we've taken it upon ourselves to curate the most significant developments for you.
Here are our top picks of cloud security highlights!
## 🐞 High Profile Vulnerabilities
## Critical and high severity 0day vulnerabilities in Exim
Multiple vulnerabilities were disclosed in Exim Mail Transfer Agent (MTA), including CVE-2023-42115, which is a critical vulnerability enabling unauthenticated attackers to remotely execute code on publicly exposed Exim servers with a specific non-default configuration. This issue results from improper input validation that leads to writing arbitrary code past the end of the buffer.
According to Wiz data, although Exim is very prevalen
Checkpoint
16th October – Threat Intelligence Report
blogs_checkpoint·2023-10-16
CVE-2023-38545 16th October – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 16th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 9th October, please download our Threat_Intelligence Bulletin .
TOP ATTACKS AND BREACHES
LockBit ransomware gang has claimed responsibility for an alleged attack on the multibillion-dollar IT products and services reseller CDW. The gang has demanded $80M ransom and threatened to release stolen data, said to include employee badges, audits, commission payout data and more. The company has isolated the affected
Talos
Top resources for Cybersecurity Awareness Month
blogs_talos·2023-10-12·CVSS 7.5
[HIGH] Top resources for Cybersecurity Awareness Month
Welcome to this week’s edition of the Threat Source newsletter.
I didn’t feel like I wanted to write anything special or witty this week given the current events in Israel and the Gaza Strip, but I will certainly advocate for any assistance readers would like to provide to the various organizations and helpers who are trying to do some good for Israeli and Palestinian civilians right now.
And since it’s still Cybersecurity Awareness Month, I also wanted to provide some links to various resources, blog posts and podcasts that I’ve found particularly helpful this month and I think you will, too.
- Countering the Rise of Ransomware (Cisco YouTube)
- Talos APJC Threat Update: How attackers are using AI
- The New Normal: How XDR is Tackling Social Engineering in Today’s World (Cisco Secure b
Talos
Top resources for Cybersecurity Awareness Month
blogs_talos·2023-10-12·CVSS 7.5
[HIGH] Top resources for Cybersecurity Awareness Month
## Top resources for Cybersecurity Awareness Month
Welcome to this week’s edition of the Threat Source newsletter.
I didn’t feel like I wanted to write anything special or witty this week given the current events in Israel and the Gaza Strip, but I will certainly advocate for any assistance readers would like to provide to the various organizations and helpers who are trying to do some good for Israeli and Palestinian civilians right now .
And since it’s still Cybersecurity Awareness Month, I also wanted to provide some links to various resources, blog posts and podcasts that I’ve found particularly helpful this month and I think you will, too.
Countering the Rise of Ransomware (Cisco YouTube)
Talos APJC Threat Update: How attackers are using AI
The New Normal: How XDR is Tackling So
Talos
What to know about the HTTP/2 Rapid Reset DDoS attacks
blogs_talos·2023-10-11·CVSS 7.5
CVE-2023-44487 [HIGH] What to know about the HTTP/2 Rapid Reset DDoS attacks
Cisco Talos is actively tracking the novel distributed denial-of-service (DDoS) attacks cloud services provider Cloudflare disclosed earlier this week. The techniques described in Cloudflare’s blog post resulted in a record-breaking DDoS attack and could facilitate much larger attacks in the future.
## CVE-2023-44487
CVE-2023-44487, a vulnerability in the HTTP/2 protocol, was recently used to launch intensive DDoS attacks against several targets. The problem lies in the way that HTTP/2 protocol handles request cancellations or resets. When a client issues a reset for an HTTP/2 request, this consumes resources on the server as it cancels the corresponding stream. However, after issuing a reset, the client can instantly open a new stream. The rapid opening and canceling of the HTTP/2 strea
Talos
What to know about the HTTP/2 Rapid Reset DDoS attacks
blogs_talos·2023-10-11·CVSS 7.5
CVE-2023-44487 [HIGH] What to know about the HTTP/2 Rapid Reset DDoS attacks
## What to know about the HTTP/2 Rapid Reset DDoS attacks
Cisco Talos is actively tracking the novel distributed denial-of-service (DDoS) attacks cloud services provider Cloudflare disclosed earlier this week. The techniques described in Cloudflare’s blog post resulted in a record-breaking DDoS attack and could facilitate much larger attacks in the future.
## CVE-2023-44487
CVE-2023-44487 , a vulnerability in the HTTP/2 protocol, was recently used to launch intensive DDoS attacks against several targets. The problem lies in the way that HTTP/2 protocol handles request cancellations or resets. When a client issues a reset for an HTTP/2 request, this consumes resources on the server as it cancels the corresponding stream. However, after issuing a reset, the client can instantly open a new
Qualys
Qualys Review: Microsoft and Adobe Security Patches October 2023 | Qualys
blogs_qualys·2023-10-10
Qualys Review: Microsoft and Adobe Security Patches October 2023 | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for October 2023
- Adobe Patches for October 2023
- Zero-day Vulnerability Patched in October Patch Tuesday Edition
- Other Critical Severity Vulnerabilities Patched in October Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
- Qualys Monthly Webinar Series
Microsoft released its October edition of Patch Tuesday! In this month’s updates, Microsoft has addressed 105 vulnerabilities in different products, features, and
Bleepingcomputer
New 'HTTP/2 Rapid Reset' zero-day attack breaks DDoS records
blogs_bleepingcomputer·2023-10-10·CVSS 7.5
[HIGH] New 'HTTP/2 Rapid Reset' zero-day attack breaks DDoS records
## New 'HTTP/2 Rapid Reset' zero-day attack breaks DDoS records
## Bill Toulas
A new DDoS (distributed denial of service) technique named 'HTTP/2 Rapid Reset' has been actively exploited as a zero-day since August, breaking all previous records in magnitude.
News of the zero-day technique comes as a coordinated announcement today between Amazon Web Services, Cloudflare, and Google, who report mitigating attacks reaching 155 million requests per second (Amazon), 201 million rps (Cloudflare), and a record-breaking 398 million rps (Google).
Google says they were able to mitigate these new attacks by adding further capacity on the edge of their network.
Cloudflare comments that the size of the attack it mitigated is three times bigger than its previous record, from February 2023 (71 milli
Trendmicro
The October 2023 Security Update Review
blogs_trendmicro·2023-10-10
The October 2023 Security Update Review
# The October 2023 Security Update Review
Get the October 2023 security update and review.
By: Dustin Childs
2023/10/10
Read time: ( words)
Save to Folio
Twenty years ago this month, Microsoft introduced the concept of “Patch Tuesday” – although the marketing folks wanted it called “Update Tuesday” (they didn’t like the word “patch”). Over the years, more companies joined the Patch Tuesday bandwagon. Here we are 20 years later, still talking about the latest security releases from Adobe and Microsoft. Pop some champagne to celebrate and join us as we review the details of the latest advisories from Adobe and Microsoft. If you’d rather watch the video recap, you can check it out here.
Adobe Patches for October 2023
For October, Adobe released three bulletins addressing 13 CVEs in Ado
Qualys
Understanding the HTTP/2 Rapid Reset Attack (CVE-2023-44487) | Qualys
blogs_qualys·2023-10-10·CVSS 7.5
CVE-2023-44487 [HIGH] Understanding the HTTP/2 Rapid Reset Attack (CVE-2023-44487) | Qualys
#### Table of Contents
- What is CVE-2023-44487 HTTP/2 Rapid Reset Attack?
- What should organizations do?
- How can Qualys Help?
- Conclusion
- Additional Contributors:
Today, Amazon Web Services, Cloudflare, and Google, in a coordinated announcement, reveal their experiences mitigating powerful HTTP/2-based DDoS attacks utilizing a zero-day technique referred to as ‘Rapid Reset’, documented under the vulnerability identifier CVE-2023-44487. The attack magnitudes reported are astonishing: Amazon mitigated attacks at a rate of 155 million requests per second, Cloudflare at 201 million rps, and Google endured a record-breaking 398 million rps. This vulnerability was under active attack in August.
## What is CVE-2023-44487 HTTP/2 Rapid Reset Attack?
The ‘Rapid Reset’ technique leverages
Bleepingcomputer
Microsoft October 2023 Patch Tuesday fixes 3 zero-days, 104 flaws
blogs_bleepingcomputer·2023-10-10·CVSS 5.3
CVE-2023-5346 [MEDIUM] Microsoft October 2023 Patch Tuesday fixes 3 zero-days, 104 flaws
## Microsoft October 2023 Patch Tuesday fixes 3 zero-days, 104 flaws
## Lawrence Abrams
26 Elevation of Privilege Vulnerabilities
3 Security Feature Bypass Vulnerabilities
45 Remote Code Execution Vulnerabilities
12 Information Disclosure Vulnerabilities
17 Denial of Service Vulnerabilities
1 Spoofing Vulnerabilities
The total count of 104 flaws does not include one Chromium vulnerability tracked as CVE-2023-5346, which was fixed by Google on October 3rd and ported to Microsoft Edge.
To learn more about the non-security updates released today, you can review our dedicated articles on the new Windows 11 KB5031354 cumulative update and Windows 10 KB5031356 cumulative update .
## Three actively exploited zero-day vulnerabilities
This month's Patch Tuesday fixes three zero-day vulne
Trendmicro
The October 2023 Security Update Review
blogs_trendmicro·2023-10-10·CVSS 6.5
[MEDIUM] The October 2023 Security Update Review
## The October 2023 Security Update Review
Get the October 2023 security update and review.
By: Dustin Childs Oct 10, 2023 Read time: ( words)
Save to Folio
Twenty years ago this month, Microsoft introduced the concept of “Patch Tuesday” – although the marketing folks wanted it called “Update Tuesday” (they didn’t like the word “patch”). Over the years, more companies joined the Patch Tuesday bandwagon. Here we are 20 years later, still talking about the latest security releases from Adobe and Microsoft. Pop some champagne to celebrate and join us as we review the details of the latest advisories from Adobe and Microsoft. If you’d rather watch the video recap, you can check it out here.
CVE
Title
Severity
CVSS
Public
Exploited
Type
CVE-2023-36563
Microsoft WordPad Information
Bleepingcomputer
Windows 10 KB5031356 update released with 25 improvements
blogs_bleepingcomputer·2023-10-10
Windows 10 KB5031356 update released with 25 improvements
## Windows 10 KB5031356 update released with 25 improvements
## Lawrence Abrams
Microsoft has released the KB5031356 cumulative update for Windows 10 21H2 and Windows 10 22H2, with twenty-five fixes for various issues.
KB5031356 is a mandatory Windows 10 cumulative update containing the October 2023 Patch Tuesday security updates.
Windows users can install this update by going into Settings , clicking on Windows Update, and manually performing a 'Check for Updates .'
As this is an mandatory update, it will automatically be installed after checking for updates. However, you will be able to schedule when your computer is restarted to finish the installation.
After installing this update, Windows 10 21H2 will be updated to build 19044.3570 and Windows 10 22H2 will be updated to 19045.35
Qualys
CVE-2023-44487 HTTP/2 Rapid Reset Attack
blogs_qualys·2023-10-10·CVSS 7.5
CVE-2023-44487 [HIGH] CVE-2023-44487 HTTP/2 Rapid Reset Attack
## Table of Contents
What is CVE-2023-44487 HTTP/2 Rapid Reset Attack?
What should organizations do?
How can Qualys Help?
Conclusion
Additional Contributors:
Today, Amazon Web Services , Cloudflare , and Google , in a coordinated announcement, reveal their experiences mitigating powerful HTTP/2-based DDoS attacks utilizing a zero-day technique referred to as ‘Rapid Reset’, documented under the vulnerability identifier CVE-2023-44487. The attack magnitudes reported are astonishing: Amazon mitigated attacks at a rate of 155 million requests per second, Cloudflare at 201 million rps, and Google endured a record-breaking 398 million rps. This vulnerability was under active attack in August.
## What is CVE-2023-44487 HTTP/2 Rapid Reset Attack?
The ‘Rapid Reset’ technique leverages the ‘
Krebs
Patch Tuesday, October 2023 Edition
blogs_krebs·2023-10-10·CVSS 4.4
CVE-2023-42724 [MEDIUM] Patch Tuesday, October 2023 Edition
Microsoft today issued security updates for more than 100 newly-discovered vulnerabilities in its Windows operating system and related software, including four flaws that are already being exploited. In addition, Apple recently released emergency updates to quash a pair of zero-day bugs in iOS.
Apple last week shipped emergency updates in iOS 17.0.3 and iPadOS 17.0.3 in response to active attacks. The patch fixes CVE-2023-42724, which attackers have been using in targeted attacks to elevate their access on a local device.
Apple said it also patched CVE-2023-5217, which is not listed as a zero-day bug. However, as Bleeping Computer pointed out, this flaw is caused by a weakness in the open-source “libvpx” video codec library, which was previously patched as a zero-day flaw by Google in th
Krebs
Patch Tuesday, October 2023 Edition
blogs_krebs·2023-10-10·CVSS 4.4
CVE-2023-42724 [MEDIUM] Patch Tuesday, October 2023 Edition
Microsoft today issued security updates for more than 100 newly-discovered vulnerabilities in its Windows operating system and related software, including four flaws that are already being exploited. In addition, Apple recently released emergency updates to quash a pair of zero-day bugs in iOS .
Apple last week shipped emergency updates in iOS 17.0.3 and iPadOS 17.0.3 in response to active attacks. The patch fixes CVE-2023-42724 , which attackers have been using in targeted attacks to elevate their access on a local device.
Apple said it also patched CVE-2023-5217 , which is not listed as a zero-day bug. However, as Bleeping Computer pointed out , this flaw is caused by a weakness in the open-source “ libvpx ” video codec library, which was previously patched as a zero-day flaw by Google
Qualys
Microsoft and Adobe Patch Tuesday, October 2023 Security Update Review
blogs_qualys·2023-10-10
Microsoft and Adobe Patch Tuesday, October 2023 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for October 2023
Adobe Patches for October 2023
Zero-day Vulnerability Patched in October Patch Tuesday Edition
Other Critical Severity Vulnerabilities Patched in October Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
Qualys Monthly Webinar Series
Microsoft released its October edition of Patch Tuesday! In this month’s updates, Microsoft has addressed 105 vulnerabilities in different products, features, and roles. Let’s t
Trendmicro
The October 2023 Security Update Review
blogs_trendmicro·2023-10-10·CVSS 6.5
[MEDIUM] The October 2023 Security Update Review
## The October 2023 Security Update Review
Get the October 2023 security update and review.
By: Dustin Childs 2023/10/10 Read time: ( words)
Save to Folio
Twenty years ago this month, Microsoft introduced the concept of “Patch Tuesday” – although the marketing folks wanted it called “Update Tuesday” (they didn’t like the word “patch”). Over the years, more companies joined the Patch Tuesday bandwagon. Here we are 20 years later, still talking about the latest security releases from Adobe and Microsoft. Pop some champagne to celebrate and join us as we review the details of the latest advisories from Adobe and Microsoft. If you’d rather watch the video recap, you can check it out here.
CVE
Title
Severity
CVSS
Public
Exploited
Type
CVE-2023-36563
Microsoft WordPad Information Di
Tenable
Microsoft’s October 2023 Patch Tuesday Addresses 103 CVEs (CVE-2023-36563, CVE-2023-41763)
blogs_tenable·2023-10-10·CVSS 6.5
[MEDIUM] Microsoft’s October 2023 Patch Tuesday Addresses 103 CVEs (CVE-2023-36563, CVE-2023-41763)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Greynoiseio
SLP Sliding Away With Reflection Amplification Thanks To CVE-2023-29552
blogs_greynoiseio·CVSS 7.5
[HIGH] SLP Sliding Away With Reflection Amplification Thanks To CVE-2023-29552
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Huntress
CVE-2023-44487 Vulnerability: Analysis, Impact, Mitigation | Huntress
blogs_huntress·CVSS 7.5
CVE-2023-44487 [HIGH] CVE-2023-44487 Vulnerability: Analysis, Impact, Mitigation | Huntress
## CVE-2023-44487 Vulnerability
Written by: Monica Burgess
Published: 11/07/25
CVE-2023-44487 is a critical vulnerability categorized as a Denial-of-Service (DoS) exploit. It targets HTTP/2 protocol implementations, allowing attackers to overwhelm servers with malicious requests, leading to service disruptions. This vulnerability is particularly concerning due to its widespread impact on web servers and cloud services.
## When was it Discovered?
CVE-2023-44487 was disclosed on October 10, 2023, by security researchers at Google and Cloudflare. The vulnerability was publicly documented shortly after, with advisories issued by major vendors to mitigate its impact.
## Affected Products & Versions
Product
Versions Affected
Fixed Versions / Patch Links
Apache HTTP Server
2.4.54 and b
Crowdstrike
October 2023 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] October 2023 Patch Tuesday: Updates and Analysis
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
Crowdstrike
October 2023 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] October 2023 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Huntress
HTTP/2 and Cybersecurity: Risks, Benefits, and Protection | Huntress
blogs_huntress
HTTP/2 and Cybersecurity: Risks, Benefits, and Protection | Huntress
## What Is HTTP/2?
HTTP/2 is the second major version of the Hypertext Transfer Protocol (HTTP), which facilitates communication between browsers and servers on the internet. Standardized in 2015 by the Internet Engineering Task Force (IETF), it was designed as the successor to HTTP/1.1, a protocol that was struggling to keep up with modern web demands.
Notably, HTTP/2 takes inspiration from Google’s SPDY (pronounced “speedy”) protocol and adds improvements to address efficiency, performance, and even security.
## Key Features of HTTP/2
HTTP/2 introduced several groundbreaking architectural changes that distinguish it from HTTP/1.1:
Multiplexing : Multiple requests and responses are handled simultaneously over a single connection, reducing latency.
Header Compression (HPACK) : Compre
Bugzilla
CVE-2023-54365 github.com/traefik/traefik: net/http2: Traefik: Denial of Service via HTTP/2 Rapid Reset technique
bugzilla·2026-06-23·CVSS 7.5
CVE-2023-54365 [HIGH] CVE-2023-54365 github.com/traefik/traefik: net/http2: Traefik: Denial of Service via HTTP/2 Rapid Reset technique
CVE-2023-54365 github.com/traefik/traefik: net/http2: Traefik: Denial of Service via HTTP/2 Rapid Reset technique
Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability.
Bugzilla
CVE-2026-47244 netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams
bugzilla·2026-06-12·CVSS 7.5
CVE-2026-47244 [HIGH] CVE-2026-47244 netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams
CVE-2026-47244 netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a singl
HackerOne
HTTP/2 CONTINUATION Flood Vulnerability
hackerone·2025-06-28
[HIGH] HTTP/2 CONTINUATION Flood Vulnerability
HTTP/2 CONTINUATION Flood Vulnerability
# **0x00 Vulnerability Overview: Fatal Flaw in HTTP/2 Protocol Stack**
## **1. HTTP/2 Header Block Fragmentation Mechanism**
* **RFC 7540 Specification**:
* Header blocks are transmitted using a HEADERS frame followed by one or more CONTINUATION frames.
* All frames must belong to the **same stream** and be sent **sequentially**.
## **2. libcurl Vulnerability**
```c
// lib/http2.c (simplified snippet)
while(recv_frame) {
if(frame.type == NGHTTP2_CONTINUATION) {
if(!h2->header_recvbuf)
h2->header_recvbuf = Curl_add_buffer_init(); // Initialize buffer
Curl_add_buffer(h2->header_recvbuf, frame.data, frame.length); // No limit
}
}
```
### **Critical Issues**:
* No upper limit on the number of CONTINUATION frames (RFC suggests continuation_count >
Bugzilla
CVE-2024-27316 httpd: CONTINUATION frames DoS
bugzilla·2024-03-06·CVSS 7.5
CVE-2024-27316 [HIGH] CVE-2024-27316 httpd: CONTINUATION frames DoS
CVE-2024-27316 httpd: CONTINUATION frames DoS
This description was provided in the disclosure from VINCE:
HTTP/2 CONTINUATION frames without the END_HEADERS flag set can be sent in a continuous stream by an attacker to an Apache Httpd implementation, which will not properly terminate the request early, causing an OOM crash.
[note: edited "which will not properly append header information in memory" to "which will not properly terminate the request early" per note from Apache in VINCE]
Discussion:
CVE-2023-44487 is something different i think you are mixing CVE...
---
Created mod_http2 tracking bugs for this issue:
Affects: fedora-all [bug 2273037]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2024:1786 https://access.redhat.com
Bugzilla
CVE-2023-45802 mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487)
bugzilla·2023-10-13·CVSS 7.5
CVE-2023-45802 [HIGH] CVE-2023-45802 mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487)
CVE-2023-45802 mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487)
The initial Rapid-Reset fix for mod_http2 was not sufficient to mitigate reset attacks completely; there is still a potential resource leak. If reset requests are sent on a connection below the rate limit imposed by nghttp2, memory is still consumed per RST and persists until the connection is broken. This "slow drip" of <1000 RST per second is sufficient to disable a single connection.
Discussion:
Created httpd tracking bugs for this issue:
Affects: fedora-all [bug 2245071]
Created mod_http2 tracking bugs for this issue:
Affects: fedora-all [bug 2245070]
---
During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connec
Bugzilla
CVE-2023-39325 golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)
bugzilla·2023-10-11·CVSS 7.5
CVE-2023-39325 [HIGH] CVE-2023-39325 golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)
CVE-2023-39325 golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded to the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing.
This CVE is specific to golang, but is also tracked as CVE-2023-44487.
Discussion:
Created golang tracking bugs for this issue:
Affects: epel-all [bug 2243616]
Affects: fedora-all [bug 2243617]
---
This issue has been addressed in the following products:
Red Hat Developer Tools
Via RHSA-2023:5719 https://access.redhat.com/errata/RH
Bugzilla
CVE-2023-44487 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
bugzilla·2023-10-09·CVSS 7.5
CVE-2023-44487 [HIGH] CVE-2023-44487 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
CVE-2023-44487 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Discussion:
Created dotnet6.0 tracking bugs for this issue:
Affects: fedora-all [bug 2243127]
Created dotnet7.0 tracking bugs for this issue:
Affects: fedora-all [bug 2243126]
---
Created flatbuffers tracking bugs for this issue:
Affects: fedora-37 [bug 2243249]
Created grpc tracking bugs for this issue:
Affects: fedora-all [bug 2243250]
Created httpd tracking bugs for this issue:
Affects: fedora-all [bug 2243247]
Created mod_http2 tracking bugs for this issue:
Affects:
https://access.redhat.com/errata/RHSA-2024:0485https://access.redhat.com/errata/RHSA-2024:0682https://access.redhat.com/security/cve/CVE-2023-6596https://bugzilla.redhat.com/show_bug.cgi?id=2253521https://access.redhat.com/errata/RHSA-2024:0485https://access.redhat.com/errata/RHSA-2024:0682https://access.redhat.com/security/cve/CVE-2023-6596https://bugzilla.redhat.com/show_bug.cgi?id=2253521
2024-04-25
Published
2023-10-10
Added to CISA KEV
Exploited in the wild