Vulnerability Lookup

🛡️ UBUNTU-CVE-2023-44487

⚪ Unknown ✅ No Known Exploit OSV

N/A

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Details

Severity Unknown

CVSS Score N/A

CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE N/A

Public Exploit ✅ No

Source OSV

Published 2023-10-10

Updated 2026-06-15

Modified 2026-04-22

Fix URL N/A

Affected Packages

Software	From version	Fixed in
dnsdist	—	1.6.1-1ubuntu0.1~esm1
dotnet6	—	6.0.123-0ubuntu1~22.04.1
dotnet7	—	7.0.112-0ubuntu1~22.04.1
dotnet8	—	8.0.100-8.0.0-0ubuntu1
h2o	—	2.2.5+dfsg2-6.1ubuntu2+esm1
haproxy	—	1.8.8-1ubuntu0.13+esm3
netty	—	1:4.1.48-4+deb11u2build0.22.04.1
nghttp2	—	1.43.0-1ubuntu0.1
nodejs	—	12.22.9~dfsg-1ubuntu3.6+esm2
tomcat8	—	8.5.39-1ubuntu1~18.04.3+esm4
tomcat9	—	9.0.58-1ubuntu0.2
trafficserver	—	9.1.1+ds-2ubuntu0.1~esm1

References

REPORT https://ubuntu.com/security/CVE-2023-44487

REPORT https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/

REPORT https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/

REPORT https://www.mail-archive.com/[email protected]/msg44134.html

REPORT https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/

REPORT https://my.f5.com/manage/s/article/K000137106

REPORT https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html

REPORT https://www.mail-archive.com/[email protected]/msg44134.html

REPORT https://devblogs.microsoft.com/dotnet/october-2023-updates/

ADVISORY https://ubuntu.com/security/notices/USN-6427-1

REPORT https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0

REPORT https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo

ADVISORY https://ubuntu.com/security/notices/USN-6427-2

ADVISORY https://ubuntu.com/security/notices/USN-6438-1

REPORT https://nodejs.org/en/blog/vulnerability/october-2023-security-releases

ADVISORY https://ubuntu.com/security/notices/USN-6505-1

ADVISORY https://ubuntu.com/security/notices/USN-6574-1

REPORT https://www.cve.org/CVERecord?id=CVE-2023-44487

ADVISORY https://ubuntu.com/security/notices/USN-6754-1

REPORT https://www.cisa.gov/known-exploited-vulnerabilities-catalog

ADVISORY https://ubuntu.com/security/notices/USN-6994-1

ADVISORY https://ubuntu.com/security/notices/USN-7067-1

ADVISORY https://ubuntu.com/security/notices/USN-7410-1

REPORT https://tomcat.apache.org/security-8.html

REPORT https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q

ADVISORY https://ubuntu.com/security/notices/USN-7469-1

ADVISORY https://ubuntu.com/security/notices/USN-7469-2

ADVISORY https://ubuntu.com/security/notices/USN-7469-3

ADVISORY https://ubuntu.com/security/notices/USN-7469-4

REPORT https://blog.powerdns.com/2024/02/16/powerdns-dnsdist-1.9.0-released

REPORT https://mailman.powerdns.com/pipermail/dnsdist/2023-October/001409.html

ADVISORY https://ubuntu.com/security/notices/USN-7892-1

🔗 NVD 🔗 Mitre

Similar Threats

Patch Gap Protection

Running software with known vulnerabilities?

BotEraser can help reduce exposure by blocking IPs associated with exploit activity — even before a patch is available.

Start Free →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Running software with known vulnerabilities?

Company

Resources

Services

Trusted

Subscribe