Skip to content
Fencer Vulns
high 7.5

CVE-2023-44487 kev in the critical feed json

HTTP/2 Stream Cancellation Attack

published 2023-10-10 3 y ago modified 2026-10-16 23 d ago also BIT-apisix-2023-44487 , BIT-aspnet-core-2023-44487 , BIT-contour-2023-44487 , BIT-dotnet-2023-44487 , BIT-dotnet-sdk-2023-44487 , BIT-envoy-2023-44487 , BIT-golang-2023-44487 , BIT-jenkins-2023-44487 , BIT-kong-2023-44487 , BIT-nginx-2023-44487 , BIT-nginx-gateway-2023-44487 , BIT-nginx-ingress-controller-2023-44487 , BIT-node-2023-44487 , BIT-node-min-2023-44487 , BIT-solr-2023-44487 , BIT-tomcat-2023-44487 , BIT-varnish-2023-44487 , EUVD-2023-2795 , GHSA-qppj-fm5r-hxr3 , JLSEC-2026-3

cvss
7.5
version 3.1, CNA
cisa kev
Exploited
added 2023-10-10
epss
100.0%
EPSS 100.0% chance of exploitation in 30 days, percentile 99.9%
public exploits
1
Exploit-DB

Summary

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Patch / fix

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  • swift github.com/apple/swift-nio-http2 1.28.0
  • go golang.org/x/net 0.17.0
  • maven org.apache.tomcat:tomcat-coyote 8.5.94, 9.0.81, 10.1.14, 11.0.0-M12
  • maven org.apache.tomcat.embed:tomcat-embed-core 8.5.94, 9.0.81, 10.1.14, 11.0.0-M12
  • maven org.eclipse.jetty.http2:http2-common 9.4.53, 10.0.17, 11.0.17
  • maven org.eclipse.jetty.http2:http2-server 9.4.53, 10.0.17, 11.0.17
  • maven org.eclipse.jetty.http2:jetty-http2-common 12.0.2
  • maven org.eclipse.jetty.http2:jetty-http2-server 12.0.2
  • maven com.typesafe.akka:akka-http-core 10.5.3
  • maven com.typesafe.akka:akka-http-core_2.13 10.5.3
  • maven com.typesafe.akka:akka-http-core_2.12 10.5.3
  • bitnami apisix 3.6.1
  • bitnami aspnet-core 6.0.23, 7.0.12
  • bitnami contour 1.24.6
  • bitnami dotnet 6.0.23, 7.0.12
  • bitnami dotnet-sdk 6.0.23, 7.0.12
  • bitnami envoy 1.24.12, 1.25.11, 1.26.6, 1.27.2
  • bitnami golang 1.20.10, 1.21.3
  • bitnami jenkins 2.414.3, 2.428.0
  • bitnami kong 3.4.2
  • bitnami nginx 1.25.3
  • bitnami nginx-gateway 1.25.3
  • bitnami node 18.18.2, 20.8.1
  • bitnami node-min 18.18.2, 20.8.1
  • bitnami solr 9.4.0
  • bitnami tomcat 8.5.94, 9.0.81, 10.1.14
  • bitnami varnish 6.0.12, 7.3.1, 7.4.2
  • julia Openresty_jll 1.27.1+0
  • julia nghttp2_jll 1.58.0+0
  • Siemens SINEC NMS V3.0
  • netty Debian 12 1:4.1.48-7+deb12u1
  • netty Debian 14, Debian 13 1:4.1.48-8
  • nginx Debian 14, Debian 13 1.24.0-2
  • jetty9 Debian 12 9.4.50-4+deb12u2
  • jetty9 Debian 14, Debian 13 9.4.53-1
  • dnsdist Debian 14, Debian 13 1.8.2-2
  • haproxy Debian 14, Debian 13, Debian 12 1.8.13-1
  • nghttp2 Debian 12 1.52.0-1+deb12u1

debian advisories DEBIAN-CVE-2023-44487

  • netty Ubuntu 22.04 LTS 1:4.1.48-4+deb11u2build0.22.04.1
  • dotnet6 Ubuntu 22.04 LTS 6.0.123-0ubuntu1~22.04.1
  • dotnet7 Ubuntu 22.04 LTS 7.0.112-0ubuntu1~22.04.1
  • dotnet8 Ubuntu 24.04 LTS 8.0.100-8.0.0-0ubuntu1
  • nghttp2 Ubuntu 20.04 LTS 1.40.0-1ubuntu0.2
  • nghttp2 Ubuntu 22.04 LTS 1.43.0-1ubuntu0.1
  • tomcat9 Ubuntu 20.04 LTS 9.0.31-1ubuntu0.9
  • tomcat9 Ubuntu 22.04 LTS 9.0.58-1ubuntu0.2

ubuntu advisories UBUNTU-CVE-2023-44487

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • jenkins ocp tools 4.13 2.414.3.1698292201-3.el8
  • jenkins-2-plugins ocp tools 4.13 4.13.1698292274-1.el8
  • tomcat RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-lib RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-webapps RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-el-5.0-api RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-docs-webapp RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-jsp-3.1-api RHEL 10.0 1:10.1.36-1.el10_0

red hat advisories RHSA-2023:6179RHSA-2025:16668RHSA-2025:7497RHSA-2023:5721RHSA-2024:1444RHSA-2023:7205

  • nginx SLE Module for Server Applications 15 SP6, openSUSE Leap 15.6 1.21.5-150600.10.3.1
  • nginx SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +7 more 1.21.5-150400.3.6.1
  • kubernetes1.25 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Module for Containers 15 SP6 +5 more 1.25.16-150400.9.16.1
  • kubernetes1.24 SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 1.24.17-150300.7.6.1
  • kubernetes1.24 SLE Module for Containers 15 SP5, openSUSE Leap 15.6, openSUSE Leap 15.5 1.24.17-150500.3.22.1
  • kubernetes1.24 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 1.24.17-150400.9.16.1
  • kubernetes1.27 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Module for Containers 15 SP6 +5 more 1.27.16-150400.9.10.1
  • kubernetes1.28 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Module for Containers 15 SP6 +5 more 1.28.13-150400.9.8.1

suse advisories SUSE-SU-2026:1058-1SUSE-SU-2025:0283-1SUSE-SU-2025:0282-1SUSE-SU-2024:3344-1SUSE-SU-2024:3343-1SUSE-SU-2024:3342-1

  • bun openSUSE Tumbleweed 1.4.4-1.1
  • kubevirt1.8 openSUSE Tumbleweed 1.8.3-1.1
  • kubevirt-1.8 openSUSE Tumbleweed 1.8.3-1.1
  • vinyl-cache openSUSE Tumbleweed 9.0.0-1.1
  • netty openSUSE Tumbleweed 4.1.114-1.1
  • kubernetes1.28 openSUSE Tumbleweed 1.28.13-2.1
  • tomcat openSUSE Tumbleweed 9.0.82-1.1
  • nghttp2 openSUSE Tumbleweed 1.57.0-1.1

opensuse advisories openSUSE-SU-2026:12316-1openSUSE-SU-2026:11091-1openSUSE-SU-2026:11057-1openSUSE-SU-2026:10751-1openSUSE-SU-2024:14442-1openSUSE-SU-2024:14292-1

  • httpd AlmaLinux 8 2.4.37-64.module_el8.10.0+3761+75f8c656
  • mod_md AlmaLinux 8 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa
  • mod_md AlmaLinux 8 1:2.0.8-8.module_el8.6.0+3031+fb177b09
  • mod_ssl AlmaLinux 8 1:2.4.37-64.module_el8.10.0+3761+75f8c656
  • mod_ldap AlmaLinux 8 2.4.37-64.module_el8.10.0+3761+75f8c656
  • mod_http2 AlmaLinux 8 1.15.7-10.module_el8.10.0+3832+564e7653
  • httpd-tools AlmaLinux 8 2.4.37-64.module_el8.10.0+3761+75f8c656
  • mod_session AlmaLinux 8 2.4.37-64.module_el8.10.0+3761+75f8c656

almalinux advisories ALSA-2024:3121ALSA-2024:2368ALSA-2024:1444ALSA-2023:7205ALSA-2023:6746ALSA-2023:6120

  • nghttp2 Rocky Linux 8 1.33.0-5.el8_8
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.7.0+40017+f0db1785
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.7.0+40018+a011993d
  • nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.7.0+40022+9ecc286c
  • nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.7.0+40022+9ecc286c
  • nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.7.0+40025+0e0cf6b2
  • nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.7.0+40018+a011993d
  • nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.7.0+40017+f0db1785

rocky linux advisories RLSA-2023:5837RLSA-2023:5849RLSA-2023:5869RLSA-2024:1444RLSA-2023:7205RLSA-2023:6746

  • go Alpine 3.18 1.20.10-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 1.21.3-r0
  • h2o Alpine 3.19, Alpine 3.18 2.2.6-r10
  • grpc Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 1.59.3-r0
  • nginx Alpine 3.15 1.20.2-r2
  • nginx Alpine 3.17, Alpine 3.16 1.22.1-r1
  • nginx Alpine 3.18 1.24.0-r7
  • nginx Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 1.24.0-r12

alpine advisories ALPINE-CVE-2023-44487

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • application-gateway-kubernetes-ingress CBL-Mariner 2.0, Azure Linux 3.0 1.4.0-15
  • azcopy CBL-Mariner 2.0 10.15.0-13
  • cert-manager CBL-Mariner 2.0, Azure Linux 3.0 1.11.2-5
  • cf-cli CBL-Mariner 2.0, Azure Linux 3.0 8.4.0-13
  • cmake CBL-Mariner 2.0, Azure Linux 3.0 3.21.4-10
  • containerized-data-importer CBL-Mariner 2.0, Azure Linux 3.0 1.55.0-15
  • coredns CBL-Mariner 2.0, Azure Linux 3.0 1.11.1-1
  • cri-tools CBL-Mariner 2.0 1.28.0-2

azure linux advisories AZL-31291AZL-31292AZL-31296AZL-31297AZL-31299AZL-31300

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-162-05 updated cvss 7.5

Siemens SIMATIC S7-1500 CPU family

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.5
    affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-203-04 updated cvss 7.5

Schneider Electric EcoStruxure Power Operation (Update A)

  • Schneider Electric EcoStruxure Power Operation (EPO) 2022 <=CU6 Schneider Electric EcoStruxure Power Operation (EPO) 2024 <=CU1
    affected: mitigation “If users choose not to apply the remediation mentioned above, Schneider Electric recommends the following:” community.se.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-24-074-05 updated cvss 7.5

Siemens RUGGEDCOM APE1808

  • Siemens RUGGEDCOM APE1808
    affected: fixed in V7.4.3

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-165-04 updated cvss 7.5

Siemens ST7 ScadaConnect

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Timeline

  1. Published
  2. Added to CISA KEV
  3. CISA patch deadline
  4. CISA SSVC: exploitation active
  5. First public exploit (EDB-52426)

Known exploited

Added
3 y ago
Patch by
2023-10-31 (3 y ago)
Ransomware
Not known
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor, product
IETF, HTTP/2
CISA name
HTTP/2 Rapid Reset Attack Vulnerability

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1190 Exploit Public-Facing Application exploitation
  • T1499 Endpoint Denial of Service primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

100.00% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-52426 HTTP/2 2.0 - Denial Of Service (DOS) remote, 2025-09-16
  • github.com https://github.com/micrictor/http2-rst-stream referenced PoC, tagged "exploit" by a source, unverified
  • security.netapp.com https://security.netapp.com/advisory/ntap-20240621-0006/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
swift github.com/apple/swift-nio-http2
<1.28.0
1.28.0
go golang.org/x/net
<0.17.0
0.17.0
maven org.apache.tomcat:tomcat-coyote
>=11.0.0-M1, <11.0.0-M12
>=10.0.0, <10.1.14
>=9.0.0, <9.0.81
>=8.5.0, <8.5.94
11.0.0-M12
10.1.14
9.0.81
8.5.94
maven org.apache.tomcat.embed:tomcat-embed-core
>=11.0.0-M1, <11.0.0-M12
>=10.0.0, <10.1.14
>=9.0.0, <9.0.81
>=8.5.0, <8.5.94
11.0.0-M12
10.1.14
9.0.81
8.5.94
maven org.eclipse.jetty.http2:http2-common
>=9.3.0, <9.4.53
>=10.0.0, <10.0.17
>=11.0.0, <11.0.17
9.4.53
10.0.17
11.0.17
maven org.eclipse.jetty.http2:http2-server
>=9.3.0, <9.4.53
>=10.0.0, <10.0.17
>=11.0.0, <11.0.17
9.4.53
10.0.17
11.0.17
maven org.eclipse.jetty.http2:jetty-http2-common
>=12.0.0, <12.0.2
12.0.2
maven org.eclipse.jetty.http2:jetty-http2-server
>=12.0.0, <12.0.2
12.0.2
maven com.typesafe.akka:akka-http-core
<10.5.3
10.5.3
maven com.typesafe.akka:akka-http-core_2.13
<10.5.3
10.5.3
maven com.typesafe.akka:akka-http-core_2.12
<10.5.3
10.5.3
maven com.typesafe.akka:akka-http-core_2.11
<=10.1.15
 no fix listed
bitnami apisix
<3.6.1
3.6.1
bitnami aspnet-core
>=6.0.0, <6.0.23
>=7.0.0, <7.0.12
6.0.23
7.0.12
bitnami contour
<1.24.6
1.24.6
bitnami dotnet
>=6.0.0, <6.0.23
>=7.0.0, <7.0.12
6.0.23
7.0.12
bitnami dotnet-sdk
>=6.0.0, <6.0.23
>=7.0.0, <7.0.12
6.0.23
7.0.12
bitnami envoy
<1.24.12
>=1.25.0, <1.25.11
>=1.26.0, <1.26.6
>=1.27.0, <1.27.2
1.24.12
1.25.11
1.26.6
1.27.2
bitnami golang
<1.20.10
>=1.21.0-0, <1.21.3
1.20.10
1.21.3
bitnami jenkins
<2.414.3
>=2.415.0, <2.428.0
2.414.3
2.428.0
bitnami kong
<3.4.2
3.4.2
bitnami nginx
>=1.9.5, <1.25.3
1.25.3
bitnami nginx-gateway
>=1.9.5, <1.25.3
1.25.3
bitnami node
<18.18.2
>=19.0.0, <20.8.1
18.18.2
20.8.1
bitnami node-min
<18.18.2
>=19.0.0, <20.8.1
18.18.2
20.8.1
bitnami solr
<9.4.0
9.4.0
bitnami tomcat
>=8.5.0, <8.5.94
>=9.0.0, <9.0.81
>=10.0.0, <10.1.14
8.5.94
9.0.81
10.1.14
bitnami varnish
<6.0.12
>=6.1.0, <7.3.1
>=7.4.0, <7.4.2
6.0.12
7.3.1
7.4.2
julia Openresty_jll
<1.27.1+0
1.27.1+0
julia libnode_jll
>=18.12.1+0
 no fix listed
julia nghttp2_jll
<1.58.0+0
1.58.0+0

Affected products

  • ietf http
  • Siemens RUGGEDCOM APE1808
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SINEC NMS
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Improved version constraint ranges and affected products by compiling all of the data from various sources.