What’s Vulnerable › Vulnerabilities

CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2023-10-10
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-10 · updated 2026-08-11
• Weakness: CWE-400

Description

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Affected products

• Akka Http Server: before 10.5.3 — fixed in 10.5.3
• opensearch-project data-prepper: before 2.5.0 — fixed in 2.5.0
• Apache Software Foundation Apache APISIX: before 3.6.1 — fixed in 3.6.1
• Apache Software Foundation Apache Solr: before 9.4.0 — fixed in 9.4.0
• Apache Tomcat: from 8.5.0 through 8.5.93; from 9.0.0 through 9.0.80; from 10.1.0 through 10.1.13; 11.0.0-milestone1, 11.0.0-milestone10, 11.0.0-milestone11, 11.0.0-milestone2, 11.0.0-milestone3, 11.0.0-milestone4 (+5)
• Apache Software Foundation Apache Traffic Server: from 8.0.0 before 8.1.9; from 9.0.0 before 9.2.3 — fixed in 8.1.9, 9.2.3
• Swift Project SwiftNIO HTTP2: before 1.28.0 — fixed in 1.28.0
• caddyserver caddy: before 2.7.5 — fixed in 2.7.5
• Cisco Business Process Automation (BPA): before 3.2.003.009 — fixed in 3.2.003.009
• Cisco Connected Mobile Experiences: before 11.1 — fixed in 11.1
• Cisco Crosswork Data Gateway: before 4.1.3; from 5.0.0 before 5.0.2 — fixed in 4.1.3, 5.0.2
• Cisco Crosswork Situation Manager: all versions
• Cisco Crosswork Zero Touch Provisioning: before 6.0.0 — fixed in 6.0.0
• Cisco Data Center Network Manager: all versions
• Cisco Enterprise Chat and Email: all versions
• Cisco Expressway: before x14.3.3 — fixed in x14.3.3
• Cisco Fog Director: before 1.22 — fixed in 1.22
• Cisco IOS XE: before 17.15.1 — fixed in 17.15.1
• Cisco IOS XR Software: before 7.11.2 — fixed in 7.11.2
• Cisco IoT Field Network Director (IoT-FND): before 4.11.0 — fixed in 4.11.0
• Cisco NX-OS: before 10.2\(7\); from 10.3\(1\) before 10.3\(5\); from 10.4\(1\) before 10.4\(2\) — fixed in 10.2\(7\), 10.3\(5\), 10.4\(2\)
• Cisco Prime Access Registrar: before 9.3.3 — fixed in 9.3.3
• Cisco Prime Cable Provisioning: before 7.2.1 — fixed in 7.2.1
• Cisco Prime Infrastructure: before 3.10.4 — fixed in 3.10.4
• Cisco Prime Network Registrar: before 11.2 — fixed in 11.2
• Cisco Secure Dynamic Attributes Connector: before 2.2.0 — fixed in 2.2.0
• Cisco Firepower Threat Defense Software: before 7.4.2 — fixed in 7.4.2
• Cisco Secure Malware Analytics: before 2.19.2 — fixed in 2.19.2
• Cisco Secure Web Appliance Firmware: before 15.1.0 — fixed in 15.1.0
• Cisco TelePresence Video Communication Server (VCS) Expressway: before x14.3.3 — fixed in x14.3.3

How to fix

Upgrade to a fixed version: Akka Http Server 10.5.3; opensearch-project data-prepper 2.5.0; Apache Software Foundation Apache APISIX 3.6.1; Apache Software Foundation Apache Solr 9.4.0; Apache Software Foundation Apache Traffic Server 8.1.9, 9.2.3; Swift Project SwiftNIO HTTP2 1.28.0; caddyserver caddy 2.7.5; Cisco Business Process Automation (BPA) 3.2.003.009; Cisco Connected Mobile Experiences 11.1; Cisco Crosswork Data Gateway 4.1.3, 5.0.2; Cisco Crosswork Zero Touch Provisioning 6.0.0; Cisco Expressway x14.3.3. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2023/10/10/6
• http://www.openwall.com/lists/oss-security/2023/10/10/7
• http://www.openwall.com/lists/oss-security/2023/10/13/4
• http://www.openwall.com/lists/oss-security/2023/10/13/9
• http://www.openwall.com/lists/oss-security/2023/10/18/4
• http://www.openwall.com/lists/oss-security/2023/10/18/8
• http://www.openwall.com/lists/oss-security/2023/10/19/6
• http://www.openwall.com/lists/oss-security/2023/10/20/8
• https://access.redhat.com/security/cve/cve-2023-44487
• https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/
• https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/

Get alerted when CVE-2023-44487 or the next vulnerability affects your stack