Back to CVE records
High 7.5Known exploited (CISA KEV)Published Oct 10, 2023
CVE-2023-44487The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Updated under an hour ago ()
Does this affect you?
It affects ietf http and 57 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Oct 10, 2023; federal agencies had to remediate by Oct 31, 2023. Treat that date as your deadline.
Do this next
Start free and add your stack
Free account, 1 product
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
- CVSS
- 7.5 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-400
- Known exploited
- Added to CISA KEV Oct 10, 2023; federal remediation due Oct 31, 2023Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- EPSS (exploitation in the next 30 days)
- 100.00% (percentile 100)
- Assigned by
- mitre
- NVD analysis
- Analyzed
- Record last updated
- Oct 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
ietf http ietf:http | 2.0 | CISA ADP |
Siemens RUGGEDCOM APE1808 siemens:ruggedcom_ape1808 (from the name) | all versions | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.5 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.5 | CISA ADP |
Siemens SINEC NMS siemens:sinec_nms (from the name) | before V3.0 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.5 | CISA ADP |
siemens simatic_s7-1500_cpu_1518f-4_pn/dp_mfp_firmware siemens:simatic_s7-1500_cpu_1518f-4_pn/dp_mfp_firmware | from 3.1.5 | NVD |
siemens sinec_ins siemens:sinec_ins | before 1.0; 1.0; 1.0; 1.0; 1.0; 1.0 | NVD |
siemens sinec_nms siemens:sinec_nms | before 3.0 | NVD |
siemens st7_scadaconnect siemens:st7_scadaconnect | before 1.1 | NVD |
siemens ruggedcom_ape1808_firmware siemens:ruggedcom_ape1808_firmware | all versions | NVD |
siemens simatic_s7-1500_cpu_1518-4_pn/dp_mfp_firmware siemens:simatic_s7-1500_cpu_1518-4_pn/dp_mfp_firmware | from 3.1.5 | NVD |
siemens siplus_s7-1500_cpu_1518-4_pn/dp_mfp_firmware siemens:siplus_s7-1500_cpu_1518-4_pn/dp_mfp_firmware | from 3.1.5 | NVD |
ietf http ietf:http | 2.0 | NVD |
nghttp2 nghttp2 nghttp2:nghttp2 | before 1.57.0 | NVD |
netty netty netty:netty | before 4.1.100 | NVD |
envoyproxy envoy envoyproxy:envoy | 1.24.10; 1.25.9; 1.26.4; 1.27.0 | NVD |
eclipse jetty eclipse:jetty | before 9.4.53; from 10.0.0 before 10.0.17; from 11.0.0 before 11.0.17; from 12.0.0 before 12.0.2 | NVD |
caddyserver caddy caddyserver:caddy | before 2.7.5 | NVD |
golang go golang:go | before 1.20.10; from 1.21.0 before 1.21.3 | NVD |
golang http2 golang:http2 | before 0.17.0 | NVD |
golang networking golang:networking | before 0.17.0 | NVD |
f5 big-ip_access_policy_manager f5:big-ip_access_policy_manager | from 13.1.0 through 13.1.5; from 14.1.0 through 14.1.5; from 15.1.0 through 15.1.10; from 16.1.0 through 16.1.4; 17.1.0 | NVD |
f5 big-ip_advanced_firewall_manager f5:big-ip_advanced_firewall_manager | from 13.1.0 through 13.1.5; from 14.1.0 through 14.1.5; from 15.1.0 through 15.1.10; from 16.1.0 through 16.1.4; 17.1.0 | NVD |
f5 big-ip_advanced_web_application_firewall f5:big-ip_advanced_web_application_firewall | from 13.1.0 through 13.1.5; from 14.1.0 through 14.1.5; from 15.1.0 through 15.1.10; from 16.1.0 through 16.1.4; 17.1.0 | NVD |
f5 big-ip_analytics f5:big-ip_analytics | from 13.1.0 through 13.1.5; from 14.1.0 through 14.1.5; from 15.1.0 through 15.1.10; from 16.1.0 through 16.1.4; 17.1.0 | NVD |
f5 big-ip_application_acceleration_manager f5:big-ip_application_acceleration_manager | from 13.1.0 through 13.1.5; from 14.1.0 through 14.1.5; from 15.1.0 through 15.1.10; from 16.1.0 through 16.1.4; 17.1.0 | NVD |
f5 big-ip_application_security_manager f5:big-ip_application_security_manager | from 13.1.0 through 13.1.5; from 14.1.0 through 14.1.5; from 15.1.0 through 15.1.10; from 16.1.0 through 16.1.4; 17.1.0 | NVD |
f5 big-ip_application_visibility_and_reporting f5:big-ip_application_visibility_and_reporting | from 13.1.0 through 13.1.5; from 14.1.0 through 14.1.5; from 15.1.0 through 15.1.10; from 16.1.0 through 16.1.4; 17.1.0 | NVD |
f5 big-ip_carrier-grade_nat f5:big-ip_carrier-grade_nat | from 13.1.0 through 13.1.5; from 14.1.0 through 14.1.5; from 15.1.0 through 15.1.10; from 16.1.0 through 16.1.4; 17.1.0 | NVD |
f5 big-ip_ddos_hybrid_defender f5:big-ip_ddos_hybrid_defender | from 13.1.0 through 13.1.5; from 14.1.0 through 14.1.5; from 15.1.0 through 15.1.10; from 16.1.0 through 16.1.4; 17.1.0 | NVD |
f5 big-ip_domain_name_system f5:big-ip_domain_name_system | from 13.1.0 through 13.1.5; from 14.1.0 through 14.1.5; from 15.1.0 through 15.1.10; from 16.1.0 through 16.1.4; 17.1.0 | NVD |
f5 big-ip_fraud_protection_service f5:big-ip_fraud_protection_service | from 13.1.0 through 13.1.5; from 14.1.0 through 14.1.5; from 15.1.0 through 15.1.10; from 16.1.0 through 16.1.4; 17.1.0 | NVD |
f5 big-ip_global_traffic_manager f5:big-ip_global_traffic_manager | from 13.1.0 through 13.1.5; from 14.1.0 through 14.1.5; from 15.1.0 through 15.1.10; from 16.1.0 through 16.1.4; 17.1.0 | NVD |
f5 big-ip_link_controller f5:big-ip_link_controller | from 13.1.0 through 13.1.5; from 14.1.0 through 14.1.5; from 15.1.0 through 15.1.10; from 16.1.0 through 16.1.4; 17.1.0 | NVD |
f5 big-ip_local_traffic_manager f5:big-ip_local_traffic_manager | from 13.1.0 through 13.1.5; from 14.1.0 through 14.1.5; from 15.1.0 through 15.1.10; from 16.1.0 through 16.1.4; 17.1.0 | NVD |
f5 big-ip_next f5:big-ip_next | 20.0.1 | NVD |
f5 big-ip_next_service_proxy_for_kubernetes f5:big-ip_next_service_proxy_for_kubernetes | from 1.5.0 through 1.8.2 | NVD |
f5 big-ip_policy_enforcement_manager f5:big-ip_policy_enforcement_manager | from 13.1.0 through 13.1.5; from 14.1.0 through 14.1.5; from 15.1.0 through 15.1.10; from 16.1.0 through 16.1.4; 17.1.0 | NVD |
f5 big-ip_ssl_orchestrator f5:big-ip_ssl_orchestrator | from 13.1.0 through 13.1.5; from 14.1.0 through 14.1.5; from 15.1.0 through 15.1.10; from 16.1.0 through 16.1.4; 17.1.0 | NVD |
f5 big-ip_webaccelerator f5:big-ip_webaccelerator | from 13.1.0 through 13.1.5; from 14.1.0 through 14.1.5; from 15.1.0 through 15.1.10; from 16.1.0 through 16.1.4; 17.1.0 | NVD |
f5 big-ip_websafe f5:big-ip_websafe | from 13.1.0 through 13.1.5; from 14.1.0 through 14.1.5; from 15.1.0 through 15.1.10; from 16.1.0 through 16.1.4; 17.1.0 | NVD |
f5 nginx f5:nginx | from 1.9.5 through 1.25.2 | NVD |
f5 nginx_ingress_controller f5:nginx_ingress_controller | from 2.0.0 through 2.4.2; from 3.0.0 through 3.3.0 | NVD |
f5 nginx_plus f5:nginx_plus | from r25 before r29; r29; r30 | NVD |
apache tomcat apache:tomcat | from 8.5.0 through 8.5.93; from 9.0.0 through 9.0.80; from 10.1.0 through 10.1.13; 11.0.0; 11.0.0; 11.0.0; 11.0.0; 11.0.0; and 6 more ranges | NVD |
apple swiftnio_http/2 apple:swiftnio_http/2 | before 1.28.0 | NVD |
grpc grpc grpc:grpc | before 1.56.3; through 1.59.2; from 1.58.0 before 1.58.3; 1.57.0 | NVD |
microsoft .net microsoft:.net | from 6.0.0 before 6.0.23; from 7.0.0 before 7.0.12 | NVD |
microsoft asp.net_core microsoft:asp.net_core | from 6.0.0 before 6.0.23; from 7.0.0 before 7.0.12 | NVD |
microsoft azure_kubernetes_service microsoft:azure_kubernetes_service | before 2023-10-08 | NVD |
microsoft visual_studio_2022 microsoft:visual_studio_2022 | from 17.0 before 17.2.20; from 17.4 before 17.4.12; from 17.6 before 17.6.8; from 17.7 before 17.7.5 | NVD |
microsoft windows_10_1607 microsoft:windows_10_1607 | before 10.0.14393.6351; before 10.0.14393.6351 | NVD |
microsoft windows_10_1809 microsoft:windows_10_1809 | before 10.0.17763.4974 | NVD |
microsoft windows_10_21h2 microsoft:windows_10_21h2 | before 10.0.19044.3570 | NVD |
microsoft windows_10_22h2 microsoft:windows_10_22h2 | before 10.0.19045.3570 | NVD |
microsoft windows_11_21h2 microsoft:windows_11_21h2 | before 10.0.22000.2538 | NVD |
microsoft windows_11_22h2 microsoft:windows_11_22h2 | before 10.0.22621.2428 | NVD |
microsoft windows_server_2016 microsoft:windows_server_2016 | all versions | NVD |
microsoft windows_server_2019 microsoft:windows_server_2019 | all versions | NVD |
References
- https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73
- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/technical-description, vendor-advisory
- https://aws.amazon.com/security/security-bulletins/AWS-2023-011/third-party-advisory
- https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attacktechnical-description, vendor-advisory
- https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
- https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/technical-description, vendor-advisory
- https://news.ycombinator.com/item?id=37831062
- https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/third-party-advisory, vendor-advisory
- https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack
- https://github.com/envoyproxy/envoy/pull/30055
- https://github.com/haproxy/haproxy/issues/2312
- https://github.com/eclipse/jetty.project/issues/10679
- https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764
- https://github.com/nghttp2/nghttp2/pull/1961
- https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
- https://github.com/alibaba/tengine/issues/1872
- https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2
- https://news.ycombinator.com/item?id=37830987
- https://news.ycombinator.com/item?id=37830998
- https://github.com/caddyserver/caddy/issues/5877
- https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/
- https://github.com/bcdannyboy/CVE-2023-44487
- https://github.com/grpc/grpc-go/pull/6703
- https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244
- https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0
- http://www.openwall.com/lists/oss-security/2023/10/10/6mailing-list, third-party-advisory
- http://www.openwall.com/lists/oss-security/2023/10/10/7mailing-list, third-party-advisory
- http://www.openwall.com/lists/oss-security/2023/10/13/4mailing-list, third-party-advisory
- http://www.openwall.com/lists/oss-security/2023/10/13/9mailing-list, third-party-advisory
- http://www.openwall.com/lists/oss-security/2023/10/18/4mailing-list, third-party-advisory
- http://www.openwall.com/lists/oss-security/2023/10/18/8mailing-list, third-party-advisory
- http://www.openwall.com/lists/oss-security/2023/10/19/6mailing-list, third-party-advisory
- http://www.openwall.com/lists/oss-security/2023/10/20/8mailing-list, third-party-advisory
- https://access.redhat.com/security/cve/cve-2023-44487vendor-advisory
- https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/press/media-coverage, third-party-advisory
- https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/vendor-advisory
- https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attackpress/media-coverage, third-party-advisory
- https://blog.vespa.ai/cve-2023-44487/vendor-advisory
- https://bugzilla.proxmox.com/show_bug.cgi?id=4988issue-tracking, third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2242803issue-tracking, vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.