7.5

CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability

KEV
Analyzed
AliasesALPINE-CVE-2023-44487SUSE-SU-2023:4163-1SUSE-SU-2023:4199-1
Published 10-10-2023Last modified 14-10-2026

Vulnerability summary

CVE-2023-44487 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in IETF HTTP/2. It is known to be exploited: CISA lists it, first on 10-10-2023. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 3 public exploits are recorded.

Priority
Act nowlisted as exploited

Listed as exploited by CISA (10-10-2023)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
100.00%
0%100%
Critical · 0.00 pp in 30 days
KEVExploited in the wildCritical · listed in 1 catalog
RansomwareNot flaggedNo ransomware use recorded.
Public exploits3github, reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 105 · Related 238
DLA-3617-1DLA-3621-1DLA-3641-1DLA-3645-1DSA-5521-1DSA-5522-1

Showing 100 of 304.

Timeline

  1. 10-10-2023
    PublishedVulnerability first disclosed.
  2. 10-10-2023
    Added to CISA KEVExploitedHTTP/2 Rapid Reset Attack Vulnerability
  3. 31-10-2023
    CISA remediation dueDeadline passedApply mitigations per vendor instructions.
  4. 14-10-2026
    Last modifiedVulnerability information updated.

Description

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS metrics

12 scores · 10 sources · 2 versions

EPSS trend

Probability

100.00%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 100.00% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
10-10-2023
Federal due date
31-10-2023
ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ nvd.nist.gov/vuln/detail/CVE-2023-44487

Public exploits

3 found
  • githubUnverified

    Http2 Rst Stream

    Maturity: poc

  • referenceUnverified

    Exploit Reference (security.netapp.com)

    Maturity: unknown

  • exploit-databaseremotemultipleUnverified

    HTTP/2 2.0 - Denial Of Service (DOS)

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard152 products
  • aactl< 0.4.12-r49
  • amass< 5.1.1-r1
  • atlantis< 0.26.0-r3
  • atlantis-fips< 0.26.0-r3
  • aws-efs-csi-driver< 1.7.0-r6
Wolfi27 products
  • aactl< 0.4.12-r49
  • amass< 5.1.1-r1
  • atlantis< 0.26.0-r3
  • aws-efs-csi-driver< 1.7.0-r6
  • bom< 0.6.0-r0
Alpine15 products
  • dotnet6-build< 6.0.124-r0
  • dotnet6-runtime< 6.0.24-r0
  • dotnet7-build< 7.0.113-r0
  • dotnet7-runtime< 7.0.13-r0
  • go≥ 1.21.0, < 1.20.10-r0 | ≥ 1.21.0, < 1.21.3-r0
Apache4 products
  • apisix< 3.6.1
  • solr< 9.4.0
  • tomcat≥ 8.5.0, ≤ 8.5.93 | ≥ 9.0.0, ≤ 9.0.80 | ≥ 10.1.0, ≤ 10.1.13 | 11.0.0:milestone1 | 11.0.0:milestone10 | 11.0.0:milestone11 | 11.0.0:milestone2 | 11.0.0:milestone3 | 11.0.0:milestone4 | 11.0.0:milestone5 | 11.0.0:milestone6 | 11.0.0:milestone7 | 11.0.0:milestone8 | 11.0.0:milestone9
  • traffic_server≥ 8.0.0, < 8.1.9 | ≥ 9.0.0, < 9.2.3
Akka1 product
Amazon1 product

6 vendors · 200 products · Showing 200 of 717

References

392 links
Show all 100 references

Showing 100 of 392.