CVE-2023-44487: HTTP/2 Rapid Reset Attack, actively exploited

Description

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityNone

IntegrityNone

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Akka HTTP Server< 10.5.3

Amazon Opensearch Data Prepper< 2.5.0

Apache Apisix< 3.6.1

Apache Solr< 9.4.0

Apache Tomcat≥ 10.1.0 ≤ 10.1.13 · ≥ 8.5.0 ≤ 8.5.93 · ≥ 9.0.0 ≤ 9.0.80 · 11.0.0

Apache Traffic Server≥ 8.0.0 < 8.1.9 · ≥ 9.0.0 < 9.2.3

Apple Swiftnio Http/2< 1.28.0

Caddyserver Caddy< 2.7.5

Cisco Business Process Automation< 3.2.003.009

Cisco Connected Mobile Experiences< 11.1

Cisco Crosswork Data Gateway≥ 5.0.0 < 5.0.2 · < 4.1.3

Cisco Crosswork Situation Managerall versions

Cisco Crosswork Zero Touch Provisioning< 6.0.0

Cisco Data Center Network Managerall versions

Cisco Enterprise Chat And Emailall versions

Cisco Expressway< x14.3.3

Cisco IoT Field Network Director< 4.11.0

Cisco Prime Access Registrar< 9.3.3

Cisco Prime Cable Provisioning< 7.2.1

Cisco Prime Infrastructure< 3.10.4

Cisco Prime Network Registrar< 11.2

Cisco Secure Dynamic Attributes Connector< 2.2.0

Cisco Secure Firewall Threat Defense< 7.4.2

Cisco Secure Malware Analytics< 2.19.2

Remediation

Fixed in

Akka HTTP Server≥ 10.5.3

Amazon Opensearch Data Prepper≥ 2.5.0

Apache Apisix≥ 3.6.1

Apache Solr≥ 9.4.0

Apache Traffic Server≥ 8.1.9

Apple Swiftnio Http/2≥ 1.28.0

Caddyserver Caddy≥ 2.7.5

Cisco Business Process Automation≥ 3.2.003.009

Cisco Connected Mobile Experiences≥ 11.1

Cisco Crosswork Data Gateway≥ 5.0.2

Patch & vendor advisories

References

https://access.redhat.com/security/cve/cve-2023-44487Vendor Advisory
https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/Press/Media CoverageThird Party Advisory
https://aws.amazon.com/security/security-bulletins/AWS-2023-011/Third Party Advisory
https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/Technical DescriptionVendor Advisory
https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/Third Party AdvisoryVendor Advisory
https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/Vendor Advisory
https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attackPress/Media CoverageThird Party Advisory
https://blog.vespa.ai/cve-2023-44487/Vendor Advisory
https://bugzilla.proxmox.com/show_bug.cgi?id=4988Issue TrackingThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2242803Issue TrackingVendor Advisory

and 163 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2023-44487 being actively exploited?

Yes. CVE-2023-44487 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 10 Oct 2023.

How severe is CVE-2023-44487?

CVE-2023-44487 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 100.0% probability of exploitation.

Which products are affected by CVE-2023-44487?

Affected products include Akka HTTP Server, Amazon Opensearch Data Prepper, Apache Apisix, Apache Solr, Apache Tomcat, and 19 more.

How do I fix CVE-2023-44487?

Upgrade affected software to a fixed version, for example Akka HTTP Server 10.5.3, Amazon Opensearch Data Prepper 2.5.0, Apache Apisix 3.6.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-44487 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo