UpHeron
All vulnerabilities

Servers and applications

CVE-2023-44487

nghttp2 - HTTP/2 Rapid Reset

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 10 Oct 2023.

Severity
High 7.5
Published
10 Oct 2023
Last changed
11 Aug 2026
Added to UpHeron
21 Oct 2026
Fixed in
1.21.4.3, 6.0.23, 7.0.12, 18.18.2, 20.8.1
Sources
NVD, nodejs

Description

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • Version 11.0.0-milestone11
  • Version 11.0.0-milestone10
  • Version 11.0.0-milestone9
  • Version 11.0.0-milestone8
All 14 release lines
  • From 8.5.0 up to 8.5.93
  • From 9.0.0 up to 9.0.80
  • From 10.1.0 up to 10.1.13
  • Version 11.0.0-milestone1
  • Version 11.0.0-milestone2
  • Version 11.0.0-milestone3
  • Version 11.0.0-milestone4
  • Version 11.0.0-milestone5
  • Version 11.0.0-milestone6
  • Version 11.0.0-milestone7
  • Version 11.0.0-milestone8
  • Version 11.0.0-milestone9
  • Version 11.0.0-milestone10
  • Version 11.0.0-milestone11
nginxServers and applications · cpe:a:f5:nginx
  • From 1.9.5 up to 1.25.2
.NETServers and applications · cpe:a:microsoft:.net
  • From 6.0.0 before 6.0.23
  • From 7.0.0 before 7.0.12
.NETServers and applications · cpe:a:microsoft:asp.net_core
  • From 6.0.0 before 6.0.23
  • From 7.0.0 before 7.0.12
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 18.0.0 before 18.18.2
  • From 20.0.0 before 20.8.1
OpenRestyServers and applications · cpe:a:openresty:openresty
  • Every version before 1.21.4.3

Known exploited

CISA name
HTTP/2 Rapid Reset Attack Vulnerability
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due for US agencies
31 Oct 2023
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-44487
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-44487
  • Node.js security release https://nodejs.org/en/blog/vulnerability/october-2023-security-releases