Skip to main content

Boteraser | Website and Server Security Solutions

🛡️ CVE-2023-44487 — .net

🟠 CVSS 8.0 — High ⚠️ Exploit Public CWE-400 NVD
8.0
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

HTTP/2 Stream Cancellation Attack

HTTP/2 Rapid reset attack

The HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.

Abuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open.

The HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.

The ability to reset streams immediately allows each connection to have an indefinite number of requests in flight. By explicitly canceling the requests, the attacker never exceeds the limit on the number of concurrent open streams. The number of in-flight requests is no longer dependent on the round-trip time (RTT), but only on the available network bandwidth.

In a typical HTTP/2 server implementation, the server will still have to do significant amounts of work for canceled requests, such as allocating new stream data structures, parsing the query and doing header decompression, and mapping the URL to a resource. For reverse proxy implementations, the request may be proxied to the backend server before the RST_STREAM frame is processed. The client on the other hand paid almost no costs for sending the requests. This creates an exploitable cost asymmetry between the server and the client.

Multiple software artifacts implementing HTTP/2 are affected. This advisory was originally ingested from the swift-nio-http2 repo advisory and their original conent follows.

swift-nio-http2 specific advisory

swift-nio-http2 is vulnerable to a denial-of-service vulnerability in which a malicious client can create and then reset a large number of HTTP/2 streams in a short period of time. This causes swift-nio-http2 to commit to a large amount of expensive work which it then throws away, including creating entirely new Channels to serve the traffic. This can easily overwhelm an EventLoop and prevent it from making forward progress.

swift-nio-http2 1.28 contains a remediation for this issue that applies reset counter using a sliding window. This constrains the number of stream resets that may occur in a given window of time. Clients violating this limit will have their connections torn down. This allows clients to continue to cancel streams for legitimate reasons, while constraining malicious actors.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity none, availability high.

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

  • Attack vector: Network — reachable from anywhere that can route to the service.
  • Attack complexity: Low — the attack works reliably, with no preparation.
  • Privileges required: None — an unauthenticated stranger can try it.
  • User interaction: None — nobody has to be tricked into anything.
  • Scope: Unchanged — the damage stays inside the vulnerable component.
  • Confidentiality impact: None.
  • Integrity impact: None.
  • Availability impact: High — total loss, or loss the attacker controls.

Weakness class

CVE-2023-44487 is classified as CWE-400: Uncontrolled Resource Consumption. A request can consume memory, CPU or storage without limit, exhausting capacity for everyone else.

Affected software

CVE-2023-44487 is recorded against 194 packages.

  • .net (from 7.0.0 up to 7.0.12)
  • 3scale-api-management-platform
  • advanced-cluster-management-for-kubernetes
  • advanced-cluster-security
  • ansible-automation-platform
  • apisix
  • armeria (fixed in 1.26.0)
  • asp.net-core (from 7.0.0 up to 7.0.12)
  • aspnet-core
  • astra-control-center
  • azure-kubernetes-service (fixed in 2023-10-08)
  • big-ip-access-policy-manager
  • big-ip-advanced-firewall-manager
  • big-ip-advanced-web-application-firewall
  • big-ip-analytics
  • big-ip-application-acceleration-manager
  • big-ip-application-security-manager
  • big-ip-application-visibility-and-reporting
  • big-ip-carrier-grade-nat
  • big-ip-ddos-hybrid-defender
  • big-ip-domain-name-system
  • big-ip-fraud-protection-service
  • big-ip-global-traffic-manager
  • big-ip-link-controller
Show the remaining 170 packages
  • big-ip-local-traffic-manager
  • big-ip-next
  • big-ip-next-service-proxy-for-kubernetes (from 1.5.0 up to 1.8.2)
  • big-ip-policy-enforcement-manager
  • big-ip-ssl-orchestrator
  • big-ip-webaccelerator
  • big-ip-websafe
  • build-of-optaplanner
  • build-of-quarkus
  • business-process-automation (fixed in 3.2.003.009)
  • caddy (fixed in 2.7.5)
  • cbl-mariner (fixed in 2023-10-11)
  • ceph-storage
  • cert-manager-operator-for-red-hat-openshift
  • certification-for-red-hat-enterprise-linux
  • cluster-autoscaler-1.26 (fixed in 1.26.4-r4)
  • cluster-autoscaler-1.26-compat (fixed in 1.26.4-r4)
  • cluster-autoscaler-1.27 (fixed in 1.27.3-r6)
  • cluster-autoscaler-1.27-compat (fixed in 1.27.3-r6)
  • cluster-autoscaler-1.28 (fixed in 1.28.0-r6)
  • cluster-autoscaler-1.28-compat (fixed in 1.28.0-r6)
  • com.typesafe.akka:akka-http-core (fixed in 10.5.3)
  • com.typesafe.akka:akka-http-core-2.11
  • com.typesafe.akka:akka-http-core-2.12 (fixed in 10.5.3)
  • com.typesafe.akka:akka-http-core-2.13 (fixed in 10.5.3)
  • connected-mobile-experiences (fixed in 11.1)
  • contour
  • cost-management
  • crosswork-data-gateway (from 5.0.0 up to 5.0.2)
  • crosswork-situation-manager
  • crosswork-zero-touch-provisioning (fixed in 6.0.0)
  • cryostat
  • data-center-network-manager
  • debian-linux
  • decision-manager
  • dotnet
  • dotnet-sdk
  • enterprise-chat-and-email
  • enterprise-linux
  • envoy
  • expressway (fixed in x14.3.3)
  • fedora
  • fence-agents-remediation-operator
  • fog-director (fixed in 1.22)
  • github.com/apple/swift-nio-http2
  • go (from 1.21.0 up to 1.21.3)
  • golang
  • golang.org/x/net
  • grpc
  • h2o (fixed in 2023-10-10)
  • http
  • http-server (fixed in 10.5.3)
  • http2 (fixed in 4.2.2)
  • integration-camel-for-spring-boot
  • integration-camel-k
  • integration-service-registry
  • ios-xe (fixed in 17.15.1)
  • ios-xr (fixed in 7.11.2)
  • iot-field-network-director (fixed in 4.11.0)
  • istio (from 1.19.0 up to 1.19.1)
  • jboss-a-mq
  • jboss-a-mq-streams
  • jboss-core-services
  • jboss-data-grid
  • jboss-enterprise-application-platform
  • jboss-fuse
  • jenkins
  • jetty (from 12.0.0 up to 12.0.2)
  • k3d (fixed in 5.6.0-r6)
  • keda-2.8 (fixed in 2.8.2-r3)
  • keda-2.9 (fixed in 2.9.1-r5)
  • kong
  • kong-gateway (fixed in 3.4.2)
  • linkerd
  • logging-subsystem-for-red-hat-openshift
  • machine-deletion-remediation-operator
  • migration-toolkit-for-applications
  • migration-toolkit-for-containers
  • migration-toolkit-for-virtualization
  • netty (fixed in 4.1.100)
  • network-observability-operator
  • networking (fixed in 0.17.0)
  • nghttp2 (fixed in 1.57.0)
  • nginx
  • nginx-gateway
  • nginx-ingress-controller
  • nginx-plus
  • node
  • node-healthcheck-operator
  • node-maintenance-operator
  • node-min
  • node.js (from 20.0.0 up to 20.8.1)
  • nx-os (from 10.4\(1\) up to 10.4\(2\))
  • oncommand-insight
  • openresty (fixed in 1.21.4.3)
  • opensearch-data-prepper (fixed in 2.5.0)
  • openshift
  • openshift-api-for-data-protection
  • openshift-container-platform
  • openshift-container-platform-assisted-installer
  • openshift-data-science
  • openshift-dev-spaces
  • openshift-developer-tools-and-services
  • openshift-distributed-tracing
  • openshift-gitops
  • openshift-pipelines
  • openshift-sandboxed-containers
  • openshift-secondary-scheduler-operator
  • openshift-serverless
  • openshift-service-mesh
  • openshift-virtualization
  • openstack-platform
  • org.apache.tomcat.embed:tomcat-embed-core (from 8.5.0 up to 8.5.94)
  • org.apache.tomcat:tomcat-coyote (from 8.5.0 up to 8.5.94)
  • org.eclipse.jetty.http2:http2-common (from 11.0.0 up to 11.0.17)
  • org.eclipse.jetty.http2:http2-server (from 11.0.0 up to 11.0.17)
  • org.eclipse.jetty.http2:jetty-http2-common (from 12.0.0 up to 12.0.2)
  • org.eclipse.jetty.http2:jetty-http2-server (from 12.0.0 up to 12.0.2)
  • prime-access-registrar (fixed in 9.3.3)
  • prime-cable-provisioning (fixed in 7.2.1)
  • prime-infrastructure (fixed in 3.10.4)
  • prime-network-registrar (fixed in 11.2)
  • process-automation
  • proxygen (fixed in 2023.10.16.00)
  • quay
  • ruggedcom-ape1808-firmware
  • run-once-duration-override-operator
  • satellite
  • secure-dynamic-attributes-connector (fixed in 2.2.0)
  • secure-firewall-threat-defense (fixed in 7.4.2)
  • secure-malware-analytics (fixed in 2.19.2)
  • secure-web-appliance-firmware (fixed in 15.1.0)
  • self-node-remediation-operator
  • service-interconnect
  • service-telemetry-framework
  • simatic-s7-1500-cpu-1518-4-pn\/dp-mfp-firmware (from 3.1.5)
  • simatic-s7-1500-cpu-1518f-4-pn\/dp-mfp-firmware (from 3.1.5)
  • sinec-ins
  • sinec-nms (fixed in 3.0)
  • single-sign-on
  • siplus-s7-1500-cpu-1518-4-pn\/dp-mfp-firmware (from 3.1.5)
  • solr
  • st7-scadaconnect (fixed in 1.1)
  • support-for-spring-boot
  • swiftnio-http\/2 (fixed in 1.28.0)
  • telepresence-video-communication-server (fixed in x14.3.3)
  • tomcat
  • traefik
  • traffic-server (from 9.0.0 up to 9.2.3)
  • ultra-cloud-core---policy-control-function
  • ultra-cloud-core---serving-gateway-function (fixed in 2024.02.0)
  • ultra-cloud-core---session-management-function (fixed in 2024.02.0)
  • unified-attendant-console-advanced
  • unified-contact-center-domain-manager
  • unified-contact-center-enterprise
  • unified-contact-center-enterprise---live-data-server (fixed in 12.6.2)
  • unified-contact-center-management-portal
  • varnish
  • varnish-cache (fixed in 2023-10-10)
  • visual-studio-2022 (from 17.7 up to 17.7.5)
  • web-terminal
  • windows-10-1607 (fixed in 10.0.14393.6351)
  • windows-10-1809 (fixed in 10.0.17763.4974)
  • windows-10-21h2 (fixed in 10.0.19044.3570)
  • windows-10-22h2 (fixed in 10.0.19045.3570)
  • windows-11-21h2 (fixed in 10.0.22000.2538)
  • windows-11-22h2 (fixed in 10.0.22621.2428)
  • windows-server-2016
  • windows-server-2019
  • windows-server-2022

Timeline and source

Published on 10 October 2023 and last revised on 11 August 2026. A public exploit is known to exist, which raises the urgency of patching considerably. A vendor advisory or fix has been published. Record sourced from NVD.

References

www.openwall.com
www.openwall.com
www.openwall.com
www.openwall.com
www.openwall.com
www.openwall.com
www.openwall.com
www.openwall.com
access.redhat.com
arstechnica.com
aws.amazon.com
blog.cloudflare.com
blog.cloudflare.com
blog.litespeedtech.com
blog.qualys.com
blog.vespa.ai
bugzilla.proxmox.com
bugzilla.redhat.com
bugzilla.suse.com
cgit.freebsd.org
cloud.google.com
cloud.google.com
community.traefik.io
discuss.hashicorp.com
edg.io
forums.swift.org
gist.github.com
github.com
github.com
github.com
github.com
github.com
github.com
github.com
github.com
github.com
github.com
github.com
github.com
github.com

Other advisories for this package

.net has other advisories on record. If you are patching this one, these are worth checking on the same host:

Same weakness in other software

These advisories are the same class of weakness (CWE-400: Uncontrolled Resource Consumption) in other software:

Details

Severity HIGH
CVSS Score 8.0
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE CWE-400
Public Exploit ⚠️ Yes
Source NVD
Published 2023-10-10
Updated 2026-08-20
Modified 2026-08-11

Affected Packages

Software From version Fixed in
.net 7.0.0 7.0.12
3scale-api-management-platform — —
advanced-cluster-management-for-kubernetes — —
advanced-cluster-security — —
ansible-automation-platform — —
apisix — —
armeria — 1.26.0
asp.net-core 7.0.0 7.0.12
aspnet-core — —
astra-control-center — —
azure-kubernetes-service — 2023-10-08
big-ip-access-policy-manager — —
big-ip-advanced-firewall-manager — —
big-ip-advanced-web-application-firewall — —
big-ip-analytics — —
big-ip-application-acceleration-manager — —
big-ip-application-security-manager — —
big-ip-application-visibility-and-reporting — —
big-ip-carrier-grade-nat — —
big-ip-ddos-hybrid-defender — —
big-ip-domain-name-system — —
big-ip-fraud-protection-service — —
big-ip-global-traffic-manager — —
big-ip-link-controller — —
big-ip-local-traffic-manager — —
big-ip-next — —
big-ip-next-service-proxy-for-kubernetes 1.5.0 1.8.2
big-ip-policy-enforcement-manager — —
big-ip-ssl-orchestrator — —
big-ip-webaccelerator — —
big-ip-websafe — —
build-of-optaplanner — —
build-of-quarkus — —
business-process-automation — 3.2.003.009
caddy — 2.7.5
cbl-mariner — 2023-10-11
ceph-storage — —
cert-manager-operator-for-red-hat-openshift — —
certification-for-red-hat-enterprise-linux — —
cluster-autoscaler-1.26 — 1.26.4-r4
cluster-autoscaler-1.26-compat — 1.26.4-r4
cluster-autoscaler-1.27 — 1.27.3-r6
cluster-autoscaler-1.27-compat — 1.27.3-r6
cluster-autoscaler-1.28 — 1.28.0-r6
cluster-autoscaler-1.28-compat — 1.28.0-r6
com.typesafe.akka:akka-http-core — 10.5.3
com.typesafe.akka:akka-http-core-2.11 — —
com.typesafe.akka:akka-http-core-2.12 — 10.5.3
com.typesafe.akka:akka-http-core-2.13 — 10.5.3
connected-mobile-experiences — 11.1
contour — —
cost-management — —
crosswork-data-gateway 5.0.0 5.0.2
crosswork-situation-manager — —
crosswork-zero-touch-provisioning — 6.0.0
cryostat — —
data-center-network-manager — —
debian-linux — —
decision-manager — —
dotnet — —
dotnet-sdk — —
enterprise-chat-and-email — —
enterprise-linux — —
envoy — —
expressway — x14.3.3
fedora — —
fence-agents-remediation-operator — —
fog-director — 1.22
github.com/apple/swift-nio-http2 — —
go 1.21.0 1.21.3
golang — —
golang.org/x/net — —
grpc — —
h2o — 2023-10-10
http — —
http-server — 10.5.3
http2 — 4.2.2
integration-camel-for-spring-boot — —
integration-camel-k — —
integration-service-registry — —
ios-xe — 17.15.1
ios-xr — 7.11.2
iot-field-network-director — 4.11.0
istio 1.19.0 1.19.1
jboss-a-mq — —
jboss-a-mq-streams — —
jboss-core-services — —
jboss-data-grid — —
jboss-enterprise-application-platform — —
jboss-fuse — —
jenkins — —
jetty 12.0.0 12.0.2
k3d — 5.6.0-r6
keda-2.8 — 2.8.2-r3
keda-2.9 — 2.9.1-r5
kong — —
kong-gateway — 3.4.2
linkerd — —
logging-subsystem-for-red-hat-openshift — —
machine-deletion-remediation-operator — —
migration-toolkit-for-applications — —
migration-toolkit-for-containers — —
migration-toolkit-for-virtualization — —
netty — 4.1.100
network-observability-operator — —
networking — 0.17.0
nghttp2 — 1.57.0
nginx — —
nginx-gateway — —
nginx-ingress-controller — —
nginx-plus — —
node — —
node-healthcheck-operator — —
node-maintenance-operator — —
node-min — —
node.js 20.0.0 20.8.1
nx-os 10.4\(1\) 10.4\(2\)
oncommand-insight — —
openresty — 1.21.4.3
opensearch-data-prepper — 2.5.0
openshift — —
openshift-api-for-data-protection — —
openshift-container-platform — —
openshift-container-platform-assisted-installer — —
openshift-data-science — —
openshift-dev-spaces — —
openshift-developer-tools-and-services — —
openshift-distributed-tracing — —
openshift-gitops — —
openshift-pipelines — —
openshift-sandboxed-containers — —
openshift-secondary-scheduler-operator — —
openshift-serverless — —
openshift-service-mesh — —
openshift-virtualization — —
openstack-platform — —
org.apache.tomcat:tomcat-coyote 8.5.0 8.5.94
org.apache.tomcat.embed:tomcat-embed-core 8.5.0 8.5.94
org.eclipse.jetty.http2:http2-common 11.0.0 11.0.17
org.eclipse.jetty.http2:http2-server 11.0.0 11.0.17
org.eclipse.jetty.http2:jetty-http2-common 12.0.0 12.0.2
org.eclipse.jetty.http2:jetty-http2-server 12.0.0 12.0.2
prime-access-registrar — 9.3.3
prime-cable-provisioning — 7.2.1
prime-infrastructure — 3.10.4
prime-network-registrar — 11.2
process-automation — —
proxygen — 2023.10.16.00
quay — —
ruggedcom-ape1808-firmware — —
run-once-duration-override-operator — —
satellite — —
secure-dynamic-attributes-connector — 2.2.0
secure-firewall-threat-defense — 7.4.2
secure-malware-analytics — 2.19.2
secure-web-appliance-firmware — 15.1.0
self-node-remediation-operator — —
service-interconnect — —
service-telemetry-framework — —
simatic-s7-1500-cpu-1518-4-pn\/dp-mfp-firmware 3.1.5 —
simatic-s7-1500-cpu-1518f-4-pn\/dp-mfp-firmware 3.1.5 —
sinec-ins — —
sinec-nms — 3.0
single-sign-on — —
siplus-s7-1500-cpu-1518-4-pn\/dp-mfp-firmware 3.1.5 —
solr — —
st7-scadaconnect — 1.1
support-for-spring-boot — —
swiftnio-http\/2 — 1.28.0
telepresence-video-communication-server — x14.3.3
tomcat — —
traefik — —
traffic-server 9.0.0 9.2.3
ultra-cloud-core---policy-control-function — —
ultra-cloud-core---serving-gateway-function — 2024.02.0
ultra-cloud-core---session-management-function — 2024.02.0
unified-attendant-console-advanced — —
unified-contact-center-domain-manager — —
unified-contact-center-enterprise — —
unified-contact-center-enterprise---live-data-server — 12.6.2
unified-contact-center-management-portal — —
varnish — —
varnish-cache — 2023-10-10
visual-studio-2022 17.7 17.7.5
web-terminal — —
windows-10-1607 — 10.0.14393.6351
windows-10-1809 — 10.0.17763.4974
windows-10-21h2 — 10.0.19044.3570
windows-10-22h2 — 10.0.19045.3570
windows-11-21h2 — 10.0.22000.2538
windows-11-22h2 — 10.0.22621.2428
windows-server-2016 — —
windows-server-2019 — —
windows-server-2022 — —

References

Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2023/10/10/6
Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2023/10/10/7
Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2023/10/13/4
Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2023/10/13/9
Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2023/10/18/4
Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2023/10/18/8
Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2023/10/19/6
Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2023/10/20/8
Issue Tracking, Third Party Advisory https://bugzilla.proxmox.com/show_bug.cgi?id=4988
Issue Tracking, Vendor Advisory https://bugzilla.redhat.com/show_bug.cgi?id=2242803
Issue Tracking, Vendor Advisory https://bugzilla.suse.com/show_bug.cgi?id=1216123
Mitigation, Patch, Vendor Advisory https://github.com/advisories/GHSA-vx74-f528-fxqg
Issue Tracking, Vendor Advisory https://github.com/caddyserver/caddy/issues/5877
Release Notes, Third Party Advisory https://github.com/caddyserver/caddy/releases/tag/v2.7.5
Issue Tracking, Mitigation, Vendor Advisory https://github.com/dotnet/announcements/issues/277
Issue Tracking, Patch https://github.com/h2o/h2o/pull/3291
Exploit, Third Party Advisory https://github.com/micrictor/http2-rst-stream
Mailing List, Release Notes, Vendor Advisory https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo
Issue Tracking, Press/Media Coverage https://news.ycombinator.com/item?id=37830998
Mailing List, Vendor Advisory https://www.debian.org/security/2023/dsa-5521
Mailing List, Vendor Advisory https://www.debian.org/security/2023/dsa-5522
Mailing List, Third Party Advisory https://www.debian.org/security/2023/dsa-5540
Mailing List, Third Party Advisory https://www.debian.org/security/2023/dsa-5549
Mailing List, Third Party Advisory https://www.debian.org/security/2023/dsa-5558
Press/Media Coverage, Third Party Advisory https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/
Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2023/10/13/4
Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2023/10/13/9
Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2023/10/18/4
Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2023/10/18/8
Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2023/10/19/6
Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2023/10/20/8
Issue Tracking, Third Party Advisory https://bugzilla.proxmox.com/show_bug.cgi?id=4988
Issue Tracking, Vendor Advisory https://bugzilla.redhat.com/show_bug.cgi?id=2242803
Issue Tracking, Vendor Advisory https://bugzilla.suse.com/show_bug.cgi?id=1216123
Mitigation, Patch, Vendor Advisory https://github.com/advisories/GHSA-vx74-f528-fxqg
Issue Tracking, Vendor Advisory https://github.com/caddyserver/caddy/issues/5877
Release Notes, Third Party Advisory https://github.com/caddyserver/caddy/releases/tag/v2.7.5
Issue Tracking, Mitigation, Vendor Advisory https://github.com/dotnet/announcements/issues/277
Issue Tracking, Patch https://github.com/h2o/h2o/pull/3291
Exploit, Third Party Advisory https://github.com/micrictor/http2-rst-stream
Mailing List, Release Notes, Vendor Advisory https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo
Issue Tracking, Press/Media Coverage https://news.ycombinator.com/item?id=37830998
Mailing List, Vendor Advisory https://www.debian.org/security/2023/dsa-5521
Mailing List, Vendor Advisory https://www.debian.org/security/2023/dsa-5522
Mailing List, Third Party Advisory https://www.debian.org/security/2023/dsa-5540
Mailing List, Third Party Advisory https://www.debian.org/security/2023/dsa-5549
Mailing List, Third Party Advisory https://www.debian.org/security/2023/dsa-5558
Press/Media Coverage, Third Party Advisory https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/

Similar Threats

Exploit Protection

Are you running .net?

CVE-2023-44487 carries CVSS 8.0 High rating and a public exploit already exists. BotEraser checks your installation against this and other known CVE records, and blocks IPs associated with exploit activity.

Check My Site For CVE-2023-44487 →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesCVECVE 2023
✓