← CVE Radar
CVE-2023-44487HTTP/2 Rapid Reset Attack Vulnerability
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
7.5 HIGHEPSS 99.99%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.5 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CISA required action
⚡ Known exploited · remediation due Oct 31, 2023
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2023-44487
- Status
- Analyzed
- Assigner (CNA)
- mitre
- Published
- Oct 10, 2023
- Last modified
- 2026-10-14 23:51 UTC
- Weaknesses
Affected Products
From NVD CPE configurations.
siemenssimatic s7-1500 cpu 1518f-4 pn/dp mfp firmware0 version ranges
No version detail published.
siemenssinec ins6 version ranges
- before 1.0
- 1.0
- 1.0 sp1
- 1.0 sp2
- 1.0 sp2 update 1
- 1.0 sp2 update 2
siemenssinec nms1 version range
- before 3.0
siemensst7 scadaconnect1 version range
- before 1.1
siemensruggedcom ape1808 firmware0 version ranges
No version detail published.
siemenssimatic s7-1500 cpu 1518-4 pn/dp mfp firmware0 version ranges
No version detail published.
siemenssiplus s7-1500 cpu 1518-4 pn/dp mfp firmware0 version ranges
No version detail published.
ietfhttp1 version range
- 2.0
nghttp2nghttp21 version range
- before 1.57.0
nettynetty1 version range
- before 4.1.100
envoyproxyenvoy4 version ranges
- 1.24.10
- 1.25.9
- 1.26.4
- 1.27.0
eclipsejetty4 version ranges
- before 9.4.53
- 10.0.0 before 10.0.17
- 11.0.0 before 11.0.17
- 12.0.0 before 12.0.2
caddyservercaddy1 version range
- before 2.7.5
golanggo2 version ranges
- before 1.20.10
- 1.21.0 before 1.21.3
golanghttp21 version range
- before 0.17.0
golangnetworking1 version range
- before 0.17.0
f5big-ip access policy manager5 version ranges
- 13.1.0 through 13.1.5
- 14.1.0 through 14.1.5
- 15.1.0 through 15.1.10
- 16.1.0 through 16.1.4
- 17.1.0
f5big-ip advanced firewall manager5 version ranges
- 13.1.0 through 13.1.5
- 14.1.0 through 14.1.5
- 15.1.0 through 15.1.10
- 16.1.0 through 16.1.4
- 17.1.0
f5big-ip advanced web application firewall5 version ranges
- 13.1.0 through 13.1.5
- 14.1.0 through 14.1.5
- 15.1.0 through 15.1.10
- 16.1.0 through 16.1.4
- 17.1.0
f5big-ip analytics5 version ranges
- 13.1.0 through 13.1.5
- 14.1.0 through 14.1.5
- 15.1.0 through 15.1.10
- 16.1.0 through 16.1.4
- 17.1.0
f5big-ip application acceleration manager5 version ranges
- 13.1.0 through 13.1.5
- 14.1.0 through 14.1.5
- 15.1.0 through 15.1.10
- 16.1.0 through 16.1.4
- 17.1.0
f5big-ip application security manager5 version ranges
- 13.1.0 through 13.1.5
- 14.1.0 through 14.1.5
- 15.1.0 through 15.1.10
- 16.1.0 through 16.1.4
- 17.1.0
f5big-ip application visibility and reporting5 version ranges
- 13.1.0 through 13.1.5
- 14.1.0 through 14.1.5
- 15.1.0 through 15.1.10
- 16.1.0 through 16.1.4
- 17.1.0
f5big-ip carrier-grade nat5 version ranges
- 13.1.0 through 13.1.5
- 14.1.0 through 14.1.5
- 15.1.0 through 15.1.10
- 16.1.0 through 16.1.4
- 17.1.0
f5big-ip ddos hybrid defender5 version ranges
- 13.1.0 through 13.1.5
- 14.1.0 through 14.1.5
- 15.1.0 through 15.1.10
- 16.1.0 through 16.1.4
- 17.1.0
f5big-ip domain name system5 version ranges
- 13.1.0 through 13.1.5
- 14.1.0 through 14.1.5
- 15.1.0 through 15.1.10
- 16.1.0 through 16.1.4
- 17.1.0
f5big-ip fraud protection service5 version ranges
- 13.1.0 through 13.1.5
- 14.1.0 through 14.1.5
- 15.1.0 through 15.1.10
- 16.1.0 through 16.1.4
- 17.1.0
f5big-ip global traffic manager5 version ranges
- 13.1.0 through 13.1.5
- 14.1.0 through 14.1.5
- 15.1.0 through 15.1.10
- 16.1.0 through 16.1.4
- 17.1.0
f5big-ip link controller5 version ranges
- 13.1.0 through 13.1.5
- 14.1.0 through 14.1.5
- 15.1.0 through 15.1.10
- 16.1.0 through 16.1.4
- 17.1.0
f5big-ip local traffic manager5 version ranges
- 13.1.0 through 13.1.5
- 14.1.0 through 14.1.5
- 15.1.0 through 15.1.10
- 16.1.0 through 16.1.4
- 17.1.0
f5big-ip next1 version range
- 20.0.1
f5big-ip next service proxy for kubernetes1 version range
- 1.5.0 through 1.8.2
f5big-ip policy enforcement manager5 version ranges
- 13.1.0 through 13.1.5
- 14.1.0 through 14.1.5
- 15.1.0 through 15.1.10
- 16.1.0 through 16.1.4
- 17.1.0
f5big-ip ssl orchestrator5 version ranges
- 13.1.0 through 13.1.5
- 14.1.0 through 14.1.5
- 15.1.0 through 15.1.10
- 16.1.0 through 16.1.4
- 17.1.0
f5big-ip webaccelerator5 version ranges
- 13.1.0 through 13.1.5
- 14.1.0 through 14.1.5
- 15.1.0 through 15.1.10
- 16.1.0 through 16.1.4
- 17.1.0
f5big-ip websafe5 version ranges
- 13.1.0 through 13.1.5
- 14.1.0 through 14.1.5
- 15.1.0 through 15.1.10
- 16.1.0 through 16.1.4
- 17.1.0
f5nginx1 version range
- 1.9.5 through 1.25.2
f5nginx ingress controller2 version ranges
- 2.0.0 through 2.4.2
- 3.0.0 through 3.3.0
f5nginx plus3 version ranges
- r25 before r29
- r29
- r30
apachetomcat14 version ranges
- 8.5.0 through 8.5.93
- 9.0.0 through 9.0.80
- 10.1.0 through 10.1.13
- 11.0.0 milestone1
- 11.0.0 milestone10
- 11.0.0 milestone11
- 11.0.0 milestone2
- 11.0.0 milestone3
- 11.0.0 milestone4
- 11.0.0 milestone5
- 11.0.0 milestone6
- 11.0.0 milestone7
- 11.0.0 milestone8
- 11.0.0 milestone9
appleswiftnio http/21 version range
- before 1.28.0
grpcgrpc4 version ranges
- before 1.56.3
- through 1.59.2
- 1.58.0 before 1.58.3
- 1.57.0
microsoft.net2 version ranges
- 6.0.0 before 6.0.23
- 7.0.0 before 7.0.12
microsoftasp.net core2 version ranges
- 6.0.0 before 6.0.23
- 7.0.0 before 7.0.12
microsoftazure kubernetes service1 version range
- before 2023-10-08
microsoftvisual studio 20224 version ranges
- 17.0 before 17.2.20
- 17.4 before 17.4.12
- 17.6 before 17.6.8
- 17.7 before 17.7.5
microsoftwindows 10 16071 version range
- before 10.0.14393.6351
microsoftwindows 10 18091 version range
- before 10.0.17763.4974
microsoftwindows 10 21h21 version range
- before 10.0.19044.3570
microsoftwindows 10 22h21 version range
- before 10.0.19045.3570
microsoftwindows 11 21h21 version range
- before 10.0.22000.2538
microsoftwindows 11 22h21 version range
- before 10.0.22621.2428
microsoftwindows server 20160 version ranges
No version detail published.
microsoftwindows server 20190 version ranges
No version detail published.
microsoftwindows server 20220 version ranges
No version detail published.
nodejsnode.js2 version ranges
- 18.0.0 before 18.18.2
- 20.0.0 before 20.8.1
microsoftcbl-mariner1 version range
- before 2023-10-11
denah2o1 version range
- before 2023-10-10
facebookproxygen1 version range
- before 2023.10.16.00
apacheapisix1 version range
- before 3.6.1
apachetraffic server2 version ranges
- 8.0.0 before 8.1.9
- 9.0.0 before 9.2.3
amazonopensearch data prepper1 version range
- before 2.5.0
debiandebian linux3 version ranges
- 10.0
- 11.0
- 12.0
kazu-yamamotohttp21 version range
- before 4.2.2
istioistio3 version ranges
- before 1.17.6
- 1.18.0 before 1.18.3
- 1.19.0 before 1.19.1
varnish cache projectvarnish cache1 version range
- before 2023-10-10
traefiktraefik4 version ranges
- before 2.10.5
- 3.0.0 beta1
- 3.0.0 beta2
- 3.0.0 beta3
projectcontourcontour1 version range
- before 2023-10-11
linkerdlinkerd5 version ranges
- 2.12.0 through 2.12.5
- 2.13.0
- 2.13.1
- 2.14.0
- 2.14.1
linecorparmeria1 version range
- before 1.26.0
redhat3scale api management platform1 version range
- 2.0
redhatadvanced cluster management for kubernetes1 version range
- 2.0
redhatadvanced cluster security2 version ranges
- 3.0
- 4.0
redhatansible automation platform1 version range
- 2.0
redhatbuild of optaplanner1 version range
- 8.0
redhatbuild of quarkus0 version ranges
No version detail published.
redhatceph storage1 version range
- 5.0
redhatcert-manager operator for red hat openshift0 version ranges
No version detail published.
redhatcertification for red hat enterprise linux2 version ranges
- 8.0
- 9.0
redhatcost management0 version ranges
No version detail published.
redhatcryostat1 version range
- 2.0
redhatdecision manager1 version range
- 7.0
redhatfence agents remediation operator0 version ranges
No version detail published.
redhatintegration camel for spring boot0 version ranges
No version detail published.
redhatintegration camel k0 version ranges
No version detail published.
redhatintegration service registry0 version ranges
No version detail published.
redhatjboss a-mq1 version range
- 7
redhatjboss a-mq streams0 version ranges
No version detail published.
redhatjboss core services0 version ranges
No version detail published.
redhatjboss data grid1 version range
- 7.0.0
redhatjboss enterprise application platform2 version ranges
- 6.0.0
- 7.0.0
redhatjboss fuse2 version ranges
- 6.0.0
- 7.0.0
redhatlogging subsystem for red hat openshift0 version ranges
No version detail published.
redhatmachine deletion remediation operator0 version ranges
No version detail published.
redhatmigration toolkit for applications1 version range
- 6.0
redhatmigration toolkit for containers0 version ranges
No version detail published.
redhatmigration toolkit for virtualization0 version ranges
No version detail published.
redhatnetwork observability operator0 version ranges
No version detail published.
redhatnode healthcheck operator0 version ranges
No version detail published.
redhatnode maintenance operator0 version ranges
No version detail published.
redhatopenshift0 version ranges
No version detail published.
redhatopenshift api for data protection0 version ranges
No version detail published.
redhatopenshift container platform1 version range
- 4.0
redhatopenshift container platform assisted installer0 version ranges
No version detail published.
redhatopenshift data science0 version ranges
No version detail published.
redhatopenshift dev spaces0 version ranges
No version detail published.
redhatopenshift developer tools and services0 version ranges
No version detail published.
redhatopenshift distributed tracing0 version ranges
No version detail published.
redhatopenshift gitops0 version ranges
No version detail published.
redhatopenshift pipelines0 version ranges
No version detail published.
redhatopenshift sandboxed containers0 version ranges
No version detail published.
redhatopenshift secondary scheduler operator0 version ranges
No version detail published.
redhatopenshift serverless0 version ranges
No version detail published.
redhatopenshift service mesh1 version range
- 2.0
redhatopenshift virtualization1 version range
- 4
redhatopenstack platform3 version ranges
- 16.1
- 16.2
- 17.1
redhatprocess automation1 version range
- 7.0
redhatquay1 version range
- 3.0.0
redhatrun once duration override operator0 version ranges
No version detail published.
redhatsatellite1 version range
- 6.0
redhatself node remediation operator0 version ranges
No version detail published.
redhatservice interconnect1 version range
- 1.0
redhatsingle sign-on1 version range
- 7.0
redhatsupport for spring boot0 version ranges
No version detail published.
redhatweb terminal0 version ranges
No version detail published.
redhatenterprise linux3 version ranges
- 6.0
- 8.0
- 9.0
redhatservice telemetry framework1 version range
- 1.5
fedoraprojectfedora2 version ranges
- 37
- 38
netappastra control center0 version ranges
No version detail published.
netapponcommand insight0 version ranges
No version detail published.
akkahttp server1 version range
- before 10.5.3
konghqkong gateway1 version range
- before 3.4.2
jenkinsjenkins2 version ranges
- through 2.414.2
- through 2.427
apachesolr1 version range
- before 9.4.0
openrestyopenresty1 version range
- before 1.21.4.3
ciscobusiness process automation1 version range
- before 3.2.003.009
ciscoconnected mobile experiences1 version range
- before 11.1
ciscocrosswork data gateway2 version ranges
- before 4.1.3
- 5.0.0 before 5.0.2
ciscocrosswork situation manager0 version ranges
No version detail published.
ciscocrosswork zero touch provisioning1 version range
- before 6.0.0
ciscodata center network manager0 version ranges
No version detail published.
ciscoenterprise chat and email0 version ranges
No version detail published.
ciscoexpressway1 version range
- before x14.3.3
ciscoiot field network director1 version range
- before 4.11.0
ciscoprime access registrar1 version range
- before 9.3.3
ciscoprime cable provisioning1 version range
- before 7.2.1
ciscoprime infrastructure1 version range
- before 3.10.4
ciscoprime network registrar1 version range
- before 11.2
ciscosecure dynamic attributes connector1 version range
- before 2.2.0
ciscosecure firewall threat defense1 version range
- before 7.4.2
ciscosecure malware analytics1 version range
- before 2.19.2
ciscotelepresence video communication server1 version range
- before x14.3.3
ciscoultra cloud core - policy control function2 version ranges
- before 2024.01.0
- 2024.01.0
ciscoultra cloud core - serving gateway function1 version range
- before 2024.02.0
ciscoultra cloud core - session management function1 version range
- before 2024.02.0
ciscounified attendant console advanced0 version ranges
No version detail published.
ciscounified contact center domain manager0 version ranges
No version detail published.
ciscounified contact center enterprise0 version ranges
No version detail published.
ciscounified contact center enterprise - live data server1 version range
- before 12.6.2
ciscounified contact center management portal0 version ranges
No version detail published.
ciscofog director1 version range
- before 1.22
ciscoios xe1 version range
- before 17.15.1
ciscoios xr1 version range
- before 7.11.2
ciscosecure web appliance firmware1 version range
- before 15.1.0
cisconx-os3 version ranges
- before 10.2(7)
- 10.3(1) before 10.3(5)
- 10.4(1) before 10.4(2)
References
- openwall.com http://www.openwall.com/lists/oss-security/2023/10/10/6
- openwall.com http://www.openwall.com/lists/oss-security/2023/10/10/7
- openwall.com http://www.openwall.com/lists/oss-security/2023/10/13/4
- openwall.com http://www.openwall.com/lists/oss-security/2023/10/13/9
- openwall.com http://www.openwall.com/lists/oss-security/2023/10/18/4
- openwall.com http://www.openwall.com/lists/oss-security/2023/10/18/8
- openwall.com http://www.openwall.com/lists/oss-security/2023/10/19/6
- openwall.com http://www.openwall.com/lists/oss-security/2023/10/20/8
- access.redhat.com https://access.redhat.com/security/cve/cve-2023-44487
- arstechnica.com https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/
- aws.amazon.com https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
- blog.cloudflare.com https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
- blog.cloudflare.com https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/
- blog.litespeedtech.com https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/
- blog.qualys.com https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack
- blog.vespa.ai https://blog.vespa.ai/cve-2023-44487/
- bugzilla.proxmox.com https://bugzilla.proxmox.com/show_bug.cgi?id=4988
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2242803
- bugzilla.suse.com https://bugzilla.suse.com/show_bug.cgi?id=1216123
- cgit.freebsd.org https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9
- cloud.google.com https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/
- cloud.google.com https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack
- community.traefik.io https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125
- discuss.hashicorp.com https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715
- edg.io https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve
- forums.swift.org https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764
- gist.github.com https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088
- github.com https://github.com/Azure/AKS/issues/3947
- github.com https://github.com/Kong/kong/discussions/11741
- github.com https://github.com/advisories/GHSA-qppj-fm5r-hxr3
- github.com https://github.com/advisories/GHSA-vx74-f528-fxqg
- github.com https://github.com/advisories/GHSA-xpw8-rcwv-8f8p
- github.com https://github.com/akka/akka-http/issues/4323
- github.com https://github.com/alibaba/tengine/issues/1872
- github.com https://github.com/apache/apisix/issues/10320
- github.com https://github.com/apache/httpd-site/pull/10
- github.com https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113
- github.com https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2
- github.com https://github.com/apache/trafficserver/pull/10564
- github.com https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487
- github.com https://github.com/bcdannyboy/CVE-2023-44487
- github.com https://github.com/caddyserver/caddy/issues/5877
- github.com https://github.com/caddyserver/caddy/releases/tag/v2.7.5
- github.com https://github.com/dotnet/announcements/issues/277
- github.com https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73
- github.com https://github.com/eclipse/jetty.project/issues/10679
- github.com https://github.com/envoyproxy/envoy/pull/30055
- github.com https://github.com/etcd-io/etcd/issues/16740
- github.com https://github.com/facebook/proxygen/pull/466
- github.com https://github.com/golang/go/issues/63417
- github.com https://github.com/grpc/grpc-go/pull/6703
- github.com https://github.com/grpc/grpc/releases/tag/v1.59.2
- github.com https://github.com/h2o/h2o/pull/3291
- github.com https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf
- github.com https://github.com/haproxy/haproxy/issues/2312
- github.com https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244
- github.com https://github.com/junkurihara/rust-rpxy/issues/97
- github.com https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1
- github.com https://github.com/kazu-yamamoto/http2/issues/93
- github.com https://github.com/kubernetes/kubernetes/pull/121120
- github.com https://github.com/line/armeria/pull/5232
- github.com https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632
- github.com https://github.com/micrictor/http2-rst-stream
- github.com https://github.com/microsoft/CBL-Mariner/pull/6381
- github.com https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
- github.com https://github.com/nghttp2/nghttp2/pull/1961
- github.com https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0
- github.com https://github.com/ninenines/cowboy/issues/1615
- github.com https://github.com/nodejs/node/pull/50121
- github.com https://github.com/openresty/openresty/issues/930
- github.com https://github.com/opensearch-project/data-prepper/issues/3474
- github.com https://github.com/oqtane/oqtane.framework/discussions/3367
- github.com https://github.com/projectcontour/contour/pull/5826
- github.com https://github.com/tempesta-tech/tempesta/issues/1986
- github.com https://github.com/varnishcache/varnish-cache/issues/3996
- groups.google.com https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo
- istio.io https://istio.io/latest/news/security/istio-security-2023-004/
- linkerd.io https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/
- lists.apache.org https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q
- lists.debian.org https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html
- lists.debian.org https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html
- lists.debian.org https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html
- lists.debian.org https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html
- lists.debian.org https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html
- lists.debian.org https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html
- lists.debian.org https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/[email protected]/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/
- lists.w3.org https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html
- mailman.nginx.org https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html
- martinthomson.github.io https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html
- msrc.microsoft.com https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/
- msrc.microsoft.com https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487
- my.f5.com https://my.f5.com/manage/s/article/K000137106
- netty.io https://netty.io/news/2023/10/10/4-1-100-Final.html
- news.ycombinator.com https://news.ycombinator.com/item?id=37830987
- news.ycombinator.com https://news.ycombinator.com/item?id=37830998
- news.ycombinator.com https://news.ycombinator.com/item?id=37831062
- news.ycombinator.com https://news.ycombinator.com/item?id=37837043
- openssf.org https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/
- seanmonstar.com https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected
- sec.cloudapps.cisco.com https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ
- security.gentoo.org https://security.gentoo.org/glsa/202311-09
- security.netapp.com https://security.netapp.com/advisory/ntap-20231016-0001/
- security.netapp.com https://security.netapp.com/advisory/ntap-20240426-0007/
- security.netapp.com https://security.netapp.com/advisory/ntap-20240621-0006/
- security.netapp.com https://security.netapp.com/advisory/ntap-20240621-0007/
- security.paloaltonetworks.com https://security.paloaltonetworks.com/CVE-2023-44487
- tomcat.apache.org https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14
- ubuntu.com https://ubuntu.com/security/CVE-2023-44487
- bleepingcomputer.com https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/
- cisa.gov https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
- darkreading.com https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event
- debian.org https://www.debian.org/security/2023/dsa-5521
- debian.org https://www.debian.org/security/2023/dsa-5522
- debian.org https://www.debian.org/security/2023/dsa-5540
- debian.org https://www.debian.org/security/2023/dsa-5549
- debian.org https://www.debian.org/security/2023/dsa-5558
- debian.org https://www.debian.org/security/2023/dsa-5570
- haproxy.com https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487
- netlify.com https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/
- nginx.com https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
- openwall.com https://www.openwall.com/lists/oss-security/2023/10/10/6
- phoronix.com https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack
- theregister.com https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/
- openwall.com http://www.openwall.com/lists/oss-security/2025/08/13/6
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/
- vicarius.io https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause
- cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-341067.html
- cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-784301.html
- cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-832273.html
- cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-915275.html
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487