HTTP/2 Rapid Reset Attack拒绝服务漏洞

详细信息

漏洞类型

其他

漏洞描述

由于HTTP/2协议请求取消可以快速重置许多流，通过在多个流上发送大量HTTP/2请求和RST_STREAM帧，远程攻击者可能会消耗过多的服务器端资源，从而造成分布式拒绝服务。

修复建议

根据使用的系统选用适配的更新，或联系供应商获取补丁程序： https://devblogs.microsoft.com/dotnet/october-2023-updates/ https://my.f5.com/manage/s/article/K000137106 https://ubuntu.com/security/CVE-2023-44487 https://github.com/haproxy/haproxy/issues/2312 https://github.com/hyperium/hyper/issues/3337 https://github.com/eclipse/jetty.project/issues/10679 https://github.com/caddyserver/caddy/issues/5877 https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ https://github.com/envoyproxy/envoy/pull/30055 https://github.com/nghttp2/nghttp2 https://github.com/alibaba/tengine/issues/1872 https://github.com/grpc/grpc-go/pull/6703

参考链接

• https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack

  OSV · Technical Description · Vendor Advisory

• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/

  CVE · Technical Description · Vendor Advisory

• https://aws.amazon.com/security/security-bulletins/AWS-2023-011/

  OSV · Vendor Advisory

• https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/

  OSV · Third Party Advisory

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487

  OSV · Mitigation · Patch · Vendor Advisory

• https://github.com/envoyproxy/envoy/pull/30055

  OSV · Patch · Vendor Advisory

• https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/

  OSV · Third Party Advisory

• https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764

  OSV · Vendor Advisory

• https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244

  OSV · Product · Vendor Advisory

• https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/

  OSV · Patch · Vendor Advisory

• https://www.debian.org/security/2023/dsa-5522

  OSV · vendor-advisory

• https://blog.vespa.ai/cve-2023-44487/

  OSV · Vendor Advisory

• https://github.com/line/armeria/pull/5232

  OSV · Issue Tracking · Patch · Vendor Advisory

• https://github.com/Azure/AKS/issues/3947

  OSV · Issue Tracking · Vendor Advisory

• http://www.openwall.com/lists/oss-security/2023/10/13/9

  OSV · mailing-list

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/

  OSV · vendor-advisory

• https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/

  OSV · Press/Media Coverage · Third Party Advisory

• https://github.com/micrictor/http2-rst-stream

  OSV · Exploit · Third Party Advisory

• https://github.com/ninenines/cowboy/issues/1615

  OSV · Issue Tracking · Vendor Advisory

• https://github.com/apache/trafficserver/pull/10564

  OSV · Patch · Vendor Advisory

• https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0

  CVE · Release Notes · Third Party Advisory

• http://www.openwall.com/lists/oss-security/2023/10/19/6

  OSV · mailing-list

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/

  OSV · vendor-advisory

• https://istio.io/latest/news/security/istio-security-2023-004/

  OSV · Vendor Advisory

• https://github.com/openresty/openresty/issues/930

  OSV · Issue Tracking · Vendor Advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/

  OSV · vendor-advisory

• https://www.debian.org/security/2023/dsa-5521

  OSV · vendor-advisory

• https://github.com/caddyserver/caddy/issues/5877

  OSV · Issue Tracking · Vendor Advisory

• https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/

  OSV · Mitigation · Vendor Advisory

• https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected

  OSV · Third Party Advisory

• https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/

  OSV · Vendor Advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/

  OSV · vendor-advisory

• https://ubuntu.com/security/CVE-2023-44487

  OSV · Vendor Advisory

• https://github.com/alibaba/tengine/issues/1872

  OSV · Issue Tracking · Vendor Advisory

• https://access.redhat.com/security/cve/cve-2023-44487

  OSV · Vendor Advisory

• https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487

  OSV · Third Party Advisory · US Government Resource

• https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2

  OSV · Product · Third Party Advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/

  OSV · vendor-advisory

• https://www.debian.org/security/2023/dsa-5540

  OSV · vendor-advisory

• https://github.com/projectcontour/contour/pull/5826

  OSV · Issue Tracking · Patch · Vendor Advisory

• https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113

  OSV · Product · Third Party Advisory

• https://github.com/nghttp2/nghttp2/pull/1961

  OSV · Patch · Vendor Advisory

• https://my.f5.com/manage/s/article/K000137106

  OSV · Vendor Advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/

  OSV · vendor-advisory

• https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/

  OSV · Vendor Advisory

• https://security.gentoo.org/glsa/202311-09

  OSV · vendor-advisory

• https://www.debian.org/security/2023/dsa-5549

  OSV · vendor-advisory

• http://www.openwall.com/lists/oss-security/2023/10/20/8

  OSV · mailing-list

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/

  OSV · vendor-advisory

• https://github.com/bcdannyboy/CVE-2023-44487

  OSV · Third Party Advisory

• https://github.com/haproxy/haproxy/issues/2312

  OSV · Issue Tracking · Vendor Advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/

  OSV · vendor-advisory

• https://security.netapp.com/advisory/ntap-20231016-0001/

  OSV · Third Party Advisory

• https://news.ycombinator.com/item?id=37830998

  OSV · Issue Tracking · Press/Media Coverage

• http://www.openwall.com/lists/oss-security/2023/10/18/4

  OSV · mailing-list

• https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/

  OSV · Vendor Advisory

• https://bugzilla.proxmox.com/show_bug.cgi?id=4988

  OSV · Issue Tracking · Third Party Advisory

• https://github.com/opensearch-project/data-prepper/issues/3474

  OSV · Issue Tracking · Patch · Vendor Advisory

• https://github.com/advisories/GHSA-qppj-fm5r-hxr3

  OSV · Vendor Advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/

  OSV · vendor-advisory

• https://news.ycombinator.com/item?id=37837043

  OSV · Issue Tracking

• https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html

  OSV · mailing-list

• https://github.com/etcd-io/etcd/issues/16740

  OSV · Issue Tracking · Patch · Vendor Advisory

• https://security.paloaltonetworks.com/CVE-2023-44487

  OSV · Vendor Advisory

• https://bugzilla.redhat.com/show_bug.cgi?id=2242803

  OSV · Issue Tracking · Vendor Advisory

• https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632

  OSV · Vendor Advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/

  OSV · vendor-advisory

• https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html

  OSV · mailing-list

• https://github.com/kazu-yamamoto/http2/issues/93

  OSV · Issue Tracking · Third Party Advisory

• https://github.com/varnishcache/varnish-cache/issues/3996

  OSV · Issue Tracking · Vendor Advisory

• https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html

  OSV · mailing-list

• https://github.com/advisories/GHSA-xpw8-rcwv-8f8p

  CVE · Patch · Vendor Advisory

• https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html

  OSV · Mailing List · Patch · Third Party Advisory

• https://github.com/caddyserver/caddy/releases/tag/v2.7.5

  OSV · Release Notes · Third Party Advisory

• https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html

  OSV · mailing-list

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/

  OSV · vendor-advisory

• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

  CVE · Technical Description · Vendor Advisory

• https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q

  OSV · Mailing List · Vendor Advisory

• https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack

  OSV · Press/Media Coverage

• https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73

  OSV · Product · Release Notes · Vendor Advisory

• https://github.com/Kong/kong/discussions/11741

  OSV · Issue Tracking · Vendor Advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/

  OSV · vendor-advisory

• https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html

  OSV · Mailing List · Third Party Advisory

• https://netty.io/news/2023/10/10/4-1-100-Final.html

  OSV · Release Notes · Vendor Advisory

• https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html

  OSV · mailing-list

• https://news.ycombinator.com/item?id=37831062

  OSV · Issue Tracking · Third Party Advisory

• https://www.openwall.com/lists/oss-security/2023/10/10/6

  OSV · Mailing List · Third Party Advisory

• https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event

  OSV · Press/Media Coverage · Third Party Advisory

• https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715

  OSV · Third Party Advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/

  OSV · vendor-advisory

• https://github.com/kubernetes/kubernetes/pull/121120

  OSV · Patch · Vendor Advisory

• http://www.openwall.com/lists/oss-security/2023/10/18/8

  OSV · mailing-list

• https://github.com/akka/akka-http/issues/4323

  OSV · Issue Tracking · Vendor Advisory

• https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo

  OSV · Mailing List · Vendor Advisory

• https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html

  OSV · mailing-list

• https://github.com/microsoft/CBL-Mariner/pull/6381

  OSV · Patch · Vendor Advisory

• http://www.openwall.com/lists/oss-security/2023/10/13/4

  OSV · mailing-list

• https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/

  OSV · Vendor Advisory

• https://github.com/grpc/grpc-go/pull/6703

  OSV · Patch · Vendor Advisory

• https://github.com/dotnet/announcements/issues/277

  OSV · Mitigation · Vendor Advisory

• https://github.com/oqtane/oqtane.framework/discussions/3367

  OSV · Issue Tracking · Vendor Advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/

  OSV · vendor-advisory

• https://github.com/eclipse/jetty.project/issues/10679

  OSV · Issue Tracking · Vendor Advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/

  OSV · vendor-advisory

• https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487

  OSV · Vendor Advisory

• https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf

  OSV · Vendor Advisory

• https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61

  CVE · Patch · Vendor Advisory

• https://github.com/golang/go/issues/63417

  OSV · Issue Tracking · Vendor Advisory

• https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1

  OSV · Patch · Third Party Advisory

• https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14

  OSV · Release Notes · Vendor Advisory

• https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html

  OSV · Third Party Advisory

• https://news.ycombinator.com/item?id=37830987

  OSV · Issue Tracking · Third Party Advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/

  OSV · vendor-advisory

• https://github.com/facebook/proxygen/pull/466

  OSV · Patch · Vendor Advisory

• https://github.com/nodejs/node/pull/50121

  OSV · Vendor Advisory

• https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487

  OSV · Vendor Advisory

• https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125

  OSV · Vendor Advisory

• https://github.com/tempesta-tech/tempesta/issues/1986

  OSV · Issue Tracking · Vendor Advisory

• https://github.com/h2o/h2o/pull/3291

  OSV · Patch · Third Party Advisory

• https://github.com/apache/apisix/issues/10320

  OSV · Issue Tracking · Vendor Advisory

• https://github.com/junkurihara/rust-rpxy/issues/97

  OSV · Issue Tracking · Vendor Advisory

• https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9

  OSV · Mailing List · Patch · Vendor Advisory

• https://www.debian.org/security/2023/dsa-5558

  OSV · vendor-advisory

• https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack

  OSV · Press/Media Coverage · Third Party Advisory

• https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html

  OSV · mailing-list

• https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088

  OSV · Third Party Advisory

• https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/

  OSV · Press/Media Coverage · Third Party Advisory

• https://github.com/apache/httpd-site/pull/10

  OSV · Issue Tracking · Vendor Advisory

• https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve

  OSV · Technical Description · Third Party Advisory

• https://bugzilla.suse.com/show_bug.cgi?id=1216123

  OSV · Issue Tracking · Vendor Advisory

• https://github.com/advisories/GHSA-vx74-f528-fxqg

  CVE · Mitigation · Patch · Vendor Advisory

• https://www.debian.org/security/2023/dsa-5570

  OSV · vendor-advisory

• https://jira.atlassian.com/browse/JSWSERVER-25398
• https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md
• https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-10
• https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3

  OSV

• https://nvd.nist.gov/vuln/detail/CVE-2023-44487

  OSV

• https://github.com/jetty/jetty.project/issues/10679

  GitHub

• https://github.com/hyperium/hyper/issues/3337

  OSV

• https://chaos.social/@icing/111210915918780532

  OSV

• https://github.com/microsoft/azurelinux/pull/6381

  GitHub

• https://github.com/linkerd/website/commit/4b9c6836471bc8270ab48aae6fd2181bc73fd632

  GitHub

• https://go.dev/cl/534215

  OSV

• https://go.dev/cl/534235

  OSV

• https://go.dev/issue/63417

  OSV

• https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ

  OSV

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/

  OSV · vendor-advisory

• https://github.com/grpc/grpc-go/releases

  OSV

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/

  OSV · vendor-advisory

• https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12

  OSV

• https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94

  OSV

• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81

  OSV

• https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size

  OSV · Press/Media Coverage · Third Party Advisory

• https://aws.amazon.com/security/security-bulletins/AWS-2023-011

  OSV · Vendor Advisory

• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack

  OSV · Vendor Advisory · Technical Description

• https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack

  OSV · Vendor Advisory

• https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty

  OSV · Vendor Advisory

• https://blog.vespa.ai/cve-2023-44487

  OSV · Vendor Advisory

• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps

  OSV · Vendor Advisory · Technical Description

• https://istio.io/latest/news/security/istio-security-2023-004

  OSV · Vendor Advisory

• https://linkerd.io/2023/10/12/linkerd-cve-2023-44487

  OSV · Vendor Advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3

  OSV · vendor-advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4

  OSV · vendor-advisory

• https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2

  OSV · Patch · Vendor Advisory

• https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response

  OSV · Third Party Advisory

• https://security.netapp.com/advisory/ntap-20231016-0001

  OSV · Third Party Advisory

• https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records

  OSV · Third Party Advisory

• https://www.eclipse.org/lists/jetty-announce/msg00181.html

  OSV

• https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487

  OSV · Vendor Advisory

• https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products

  OSV · Vendor Advisory · Mitigation

• https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday

  OSV · Press/Media Coverage · Third Party Advisory

• https://www.cve.org/CVERecord?id=CVE-2023-44487

  GitHub

• https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p

  OSV

• https://github.com/nghttp2/nghttp2/commit/72b4af6143681f528f1d237b21a9a7aee1738832

  GitHub

• https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg

  OSV

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-05
• https://github.com/helidon-io/helidon/commit/58f43670086e530750c7cb74b0bec92bf5189c79

  Snyk

• https://github.com/pgjones/hypercorn/commit/7c39c68b61012a3c30979176080861c8b00fb229

  Snyk

• https://github.com/akka/akka-http/commit/1f29fe6a8567c57dfe848a21ae883304cce5646d

  Snyk

• https://github.com/apache/tomcat/commit/76bb4bfbfeae827dce896f650655bbf6e251ed49

  Snyk

• https://github.com/apache/tomcat/commit/9cdfe25bad707f34b3e5da2994f3f1952a163c3e

  Snyk

• https://github.com/eclipse/jetty.project/commit/dbb94514dc9d3fb21fe92080f57c314e7e06a148

  Snyk

• https://github.com/gravitational/teleport/commit/15f34f927a45130408eb16ed09af5620270d4d1f

  Snyk

• https://github.com/kubernetes/apimachinery/commit/be9188050914374ee8128239e5a2e5998d7897f5

  Snyk

• https://github.com/operator-framework/operator-lifecycle-manager/commit/9ec03f07f942dc9cef736957fa152e39157d6e13

  Snyk

• https://snyk.io/blog/find-fix-http-2-rapid-reset-zero-day-vulnerability-cve-2023-44487/

  Snyk

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  Snyk

• https://security.snyk.io/vuln/SNYK-PYTHON-HYPERCORN-6371005
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGRPCGRPCGO-6085450
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGRAVITATIONALTELEPORTLIBPROXYPEER-6037114
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMOPERATORFRAMEWORKOPERATORLIFECYCLEMANAGERPKGPACKAGESERVERSERVER-6037117
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGRAVITATIONALTELEPORTLIBSERVICE-6037115
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGRAVITATIONALTELEPORTLIBOBSERVABILITYTRACING-6037113
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGRAVITATIONALTELEPORTLIBTELETERMAPISERVER-6037116
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGRAVITATIONALTELEPORTLIBDEFAULTS-6037112
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGRAVITATIONALTELEPORTLIBAUTH-6037111
• https://security.snyk.io/vuln/SNYK-JAVA-IOHELIDONHTTP-6028126
• https://security.snyk.io/vuln/SNYK-UNMANAGED-ENVOYPROXYENVOY-5953325
• https://security.snyk.io/vuln/SNYK-GOLANG-GOLANGORGXNETHTTP2-5953327
• https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHETOMCAT-5953330
• https://security.snyk.io/vuln/SNYK-GOLANG-GOOGLEGOLANGORGGRPC-5953328
• https://security.snyk.io/vuln/SNYK-GOLANG-K8SIOINGRESSNGINXIMAGES-5961539
• https://security.snyk.io/vuln/SNYK-UNMANAGED-NODEJSNODE-5962500
• https://security.snyk.io/vuln/SNYK-UNMANAGED-APACHETRAFFICSERVER-5953324
• https://security.snyk.io/vuln/SNYK-UNMANAGED-NGINX-5958920
• https://security.snyk.io/vuln/SNYK-SWIFT-APPLESWIFTNIOHTTP2-5953322
• https://security.snyk.io/vuln/SNYK-JAVA-IONETTY-5953332
• https://security.snyk.io/vuln/SNYK-GOLANG-K8SIOKUBERNETESSTAGINGSRCK8SIO-5959041
• https://security.snyk.io/vuln/SNYK-JAVA-ORGECLIPSEJETTYHTTP2-5958918
• https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHETOMCATEMBED-5953331
• https://security.snyk.io/vuln/SNYK-UNMANAGED-NGHTTP2NGHTTP2-5953323
• https://security.snyk.io/vuln/SNYK-UNMANAGED-H2OH2O-5953329
• https://security.snyk.io/vuln/SNYK-UNMANAGED-FACEBOOKPROXYGEN-5953326
• https://security.snyk.io/vuln/SNYK-UNMANAGED-ALIBABATENGINE-5958919
• https://osv.dev/vulnerability/BIT-tomcat-2023-44487

  OSV

• https://osv.dev/vulnerability/BIT-varnish-2023-44487

  OSV

• https://osv.dev/vulnerability/BIT-solr-2023-44487

  OSV

• https://osv.dev/vulnerability/BIT-nginx-2023-44487

  OSV

• https://osv.dev/vulnerability/BIT-node-2023-44487

  OSV

• https://osv.dev/vulnerability/BIT-kong-2023-44487

  OSV

• https://osv.dev/vulnerability/BIT-jenkins-2023-44487

  OSV

• https://osv.dev/vulnerability/BIT-golang-2023-44487

  OSV

• https://osv.dev/vulnerability/BIT-dotnet-2023-44487

  OSV

• https://osv.dev/vulnerability/BIT-dotnet-sdk-2023-44487

  OSV

• https://osv.dev/vulnerability/BIT-envoy-2023-44487

  OSV

• https://osv.dev/vulnerability/BIT-contour-2023-44487

  OSV

• https://osv.dev/vulnerability/BIT-aspnet-core-2023-44487

  OSV

• https://osv.dev/vulnerability/BIT-apisix-2023-44487

  OSV

• https://osv.dev/vulnerability/DSA-5570-1

  OSV

• https://osv.dev/vulnerability/DLA-3656-1

  OSV

• https://osv.dev/vulnerability/DSA-5558-1

  OSV

• https://access.redhat.com/errata/RHSA-2023:7205

  OSV

• https://access.redhat.com/security/cve/CVE-2023-38552

  OSV

• https://access.redhat.com/security/cve/CVE-2023-39331

  OSV

• https://access.redhat.com/security/cve/CVE-2023-39332

  OSV

• https://access.redhat.com/security/cve/CVE-2023-39333

  OSV

• https://access.redhat.com/security/cve/CVE-2023-45143

  OSV

• https://bugzilla.redhat.com/2242803

  OSV

• https://bugzilla.redhat.com/2244104

  OSV

• https://bugzilla.redhat.com/2244413

  OSV

• https://bugzilla.redhat.com/2244414

  OSV

• https://bugzilla.redhat.com/2244415

  OSV

• https://bugzilla.redhat.com/2244418

  OSV

• https://errata.almalinux.org/8/ALSA-2023-7205.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:7205

  OSV

• https://access.redhat.com/errata/RHSA-2023:6746

  OSV

• https://errata.almalinux.org/9/ALSA-2023-6746.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:6746

  OSV

• https://osv.dev/vulnerability/BIT-nginx-ingress-controller-2023-44487

  OSV

• https://osv.dev/vulnerability/DSA-5549-1

  OSV

• https://osv.dev/vulnerability/DLA-3645-1

  OSV

• https://github.com/grpc/grpc-go/commit/f2180b4d5403d2210b30b93098eb7da31c05c721

  OSV

• https://osv.dev/vulnerability/GO-2023-2153

  OSV

• https://osv.dev/vulnerability/DLA-3641-1

  OSV

• https://osv.dev/vulnerability/DLA-3638-1

  OSV

• https://osv.dev/vulnerability/DSA-5540-1

  OSV

• https://access.redhat.com/errata/RHSA-2023:6120

  OSV

• https://errata.almalinux.org/9/ALSA-2023-6120.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:6120

  OSV

• https://errata.rockylinux.org/RLSA-2023:5850

  OSV

• https://osv.dev/vulnerability/RLSA-2023:5850

  OSV

• https://errata.rockylinux.org/RLSA-2023:5989

  OSV

• https://osv.dev/vulnerability/RLSA-2023:5989

  OSV

• https://errata.rockylinux.org/RLSA-2023:5928

  OSV

• https://osv.dev/vulnerability/RLSA-2023:5928

  OSV

• https://errata.rockylinux.org/RLSA-2023:5863

  OSV

• https://bugzilla.redhat.com/show_bug.cgi?id=2243296

  OSV

• https://osv.dev/vulnerability/RLSA-2023:5863

  OSV

• https://errata.rockylinux.org/RLSA-2023:5721

  OSV

• https://osv.dev/vulnerability/RLSA-2023:5721

  OSV

• https://errata.rockylinux.org/RLSA-2023:5924

  OSV

• https://osv.dev/vulnerability/RLSA-2023:5924

  OSV

• https://errata.rockylinux.org/RLSA-2023:5765

  OSV

• https://osv.dev/vulnerability/RLSA-2023:5765

  OSV

• https://errata.rockylinux.org/RLSA-2023:5838

  OSV

• https://osv.dev/vulnerability/RLSA-2023:5838

  OSV

• https://errata.rockylinux.org/RLSA-2023:5749

  OSV

• https://osv.dev/vulnerability/RLSA-2023:5749

  OSV

• https://errata.rockylinux.org/RLSA-2023:5708

  OSV

• https://osv.dev/vulnerability/RLSA-2023:5708

  OSV

• https://errata.rockylinux.org/RLSA-2023:5738

  OSV

• https://bugzilla.redhat.com/show_bug.cgi?id=2228743

  OSV

• https://osv.dev/vulnerability/RLSA-2023:5738

  OSV

• https://access.redhat.com/errata/RHSA-2023:5989

  OSV

• https://errata.almalinux.org/8/ALSA-2023-5989.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5989

  OSV

• https://access.redhat.com/errata/RHSA-2023:5929

  OSV

• https://errata.almalinux.org/9/ALSA-2023-5929.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5929

  OSV

• https://access.redhat.com/errata/RHSA-2023:5928

  OSV

• https://errata.almalinux.org/8/ALSA-2023-5928.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5928

  OSV

• https://access.redhat.com/errata/RHSA-2023:5924

  OSV

• https://errata.almalinux.org/9/ALSA-2023-5924.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5924

  OSV

• https://access.redhat.com/errata/RHSA-2023:5837

  OSV

• https://errata.almalinux.org/8/ALSA-2023-5837.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5837

  OSV

• https://access.redhat.com/errata/RHSA-2023:5838

  OSV

• https://errata.almalinux.org/9/ALSA-2023-5838.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5838

  OSV

• https://access.redhat.com/errata/RHSA-2023:5849

  OSV

• https://errata.almalinux.org/9/ALSA-2023-5849.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5849

  OSV

• https://access.redhat.com/errata/RHSA-2023:5850

  OSV

• https://errata.almalinux.org/8/ALSA-2023-5850.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5850

  OSV

• https://access.redhat.com/errata/RHSA-2023:5867

  OSV

• https://access.redhat.com/security/cve/CVE-2023-39325

  OSV

• https://bugzilla.redhat.com/2243296

  OSV

• https://errata.almalinux.org/9/ALSA-2023-5867.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5867

  OSV

• https://access.redhat.com/errata/RHSA-2023:5869

  OSV

• https://errata.almalinux.org/8/ALSA-2023-5869.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5869

  OSV

• https://access.redhat.com/errata/RHSA-2023:5863

  OSV

• https://errata.almalinux.org/8/ALSA-2023-5863.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5863

  OSV

• https://access.redhat.com/errata/RHSA-2023:5765

  OSV

• https://errata.almalinux.org/9/ALSA-2023-5765.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5765

  OSV

• https://access.redhat.com/errata/RHSA-2023:5721

  OSV

• https://errata.almalinux.org/8/ALSA-2023-5721.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5721

  OSV

• https://access.redhat.com/errata/RHSA-2023:5713

  OSV

• https://errata.almalinux.org/8/ALSA-2023-5713.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5713

  OSV

• https://osv.dev/vulnerability/DLA-3621-1

  OSV

• https://access.redhat.com/errata/RHSA-2023:5749

  OSV

• https://errata.almalinux.org/9/ALSA-2023-5749.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5749

  OSV

• https://access.redhat.com/errata/RHSA-2023:5738

  OSV

• https://access.redhat.com/security/cve/CVE-2023-29409

  OSV

• https://bugzilla.redhat.com/2228743

  OSV

• https://errata.almalinux.org/9/ALSA-2023-5738.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5738

  OSV

• https://access.redhat.com/errata/RHSA-2023:5712

  OSV

• https://errata.almalinux.org/8/ALSA-2023-5712.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5712

  OSV

• https://access.redhat.com/errata/RHSA-2023:5711

  OSV

• https://errata.almalinux.org/9/ALSA-2023-5711.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5711

  OSV

• https://access.redhat.com/errata/RHSA-2023:5710

  OSV

• https://errata.almalinux.org/8/ALSA-2023-5710.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5710

  OSV

• https://access.redhat.com/errata/RHSA-2023:5708

  OSV

• https://errata.almalinux.org/9/ALSA-2023-5708.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5708

  OSV

• https://access.redhat.com/errata/RHSA-2023:5709

  OSV

• https://errata.almalinux.org/8/ALSA-2023-5709.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5709

  OSV

• https://osv.dev/vulnerability/DLA-3617-1

  OSV

• https://osv.dev/vulnerability/GO-2023-2102

  OSV

• https://github.com/apple/swift-nio-http2

  OSV

• https://osv.dev/vulnerability/GHSA-qppj-fm5r-hxr3

  OSV

• https://github.com/netty/netty

  OSV

• https://osv.dev/vulnerability/GHSA-xpw8-rcwv-8f8p

  OSV

• https://github.com/nghttp2/nghttp2

  OSV

• https://osv.dev/vulnerability/GHSA-vx74-f528-fxqg

  OSV

• https://osv.dev/vulnerability/CVE-2023-44487

  OSV

• https://osv.dev/vulnerability/DSA-5522-1

  OSV

• https://osv.dev/vulnerability/DSA-5521-1

  OSV

• https://access.redhat.com/errata/RHSA-2024:1444

  OSV

• https://access.redhat.com/security/cve/CVE-2024-22019

  OSV

• https://bugzilla.redhat.com/2264574

  OSV

• https://errata.almalinux.org/8/ALSA-2024-1444.html

  OSV

• https://osv.dev/vulnerability/ALSA-2024:1444

  OSV

• https://github.com/grpc/grpc-go/security/advisories/GHSA-m425-mq94-257g

  OSV

• https://github.com/grpc/grpc-go

  OSV

• https://osv.dev/vulnerability/GHSA-m425-mq94-257g

  OSV

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76

  OSV

• https://github.com/kumahq/kuma/security/advisories/GHSA-9wmc-rg4h-28wv

  OSV

• https://github.com/kumahq/kuma/pull/8001

  OSV

• https://github.com/kumahq/kuma/pull/8023

  OSV

• https://github.com/kumahq/kuma/pull/8034

  OSV

• https://github.com/kumahq/kuma

  OSV

• https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/edge

  OSV

• https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/?sf269548684=1

  OSV

• https://osv.dev/vulnerability/GHSA-9wmc-rg4h-28wv

  OSV

• https://security.netapp.com/advisory/ntap-20240426-0007/

  CVE · Third Party Advisory

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-04
• https://security.netapp.com/advisory/ntap-20240621-0007/

  CVE · Third Party Advisory

• https://security.netapp.com/advisory/ntap-20240621-0006/

  CVE · Third Party Advisory

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-06
• https://github.com/akka/akka-http/pull/4325

  OSV

• https://github.com/akka/akka-http/pull/4324

  OSV

• https://github.com/apache/tomcat/commit/944332bb15bd2f3bf76ec2caeb1ff0a58a3bc628

  OSV

• https://security.netapp.com/advisory/ntap-20240426-0007

  OSV · Third Party Advisory

• https://security.netapp.com/advisory/ntap-20240621-0006

  OSV · Third Party Advisory

• https://security.netapp.com/advisory/ntap-20240621-0007

  OSV · Third Party Advisory

• https://akka.io/security/akka-http-cve-2023-44487.html

  OSV

• https://www.mail-archive.com/haproxy@formilux.org/msg44134.html

  OSV

• https://devblogs.microsoft.com/dotnet/october-2023-updates/

  OSV

• https://ubuntu.com/security/notices/USN-6427-1

  OSV

• https://ubuntu.com/security/notices/USN-6427-2

  OSV

• https://ubuntu.com/security/notices/USN-6438-1

  OSV

• https://nodejs.org/en/blog/vulnerability/october-2023-security-releases

  OSV

• https://ubuntu.com/security/notices/USN-6505-1

  OSV

• https://ubuntu.com/security/notices/USN-6574-1

  OSV

• https://ubuntu.com/security/notices/USN-6754-1

  OSV

• https://ubuntu.com/security/notices/USN-6994-1

  OSV

• https://osv.dev/vulnerability/UBUNTU-CVE-2023-44487

  OSV

• https://osv.dev/vulnerability/CGA-5jp5-95p2-jw83

  OSV

• https://osv.dev/vulnerability/CGA-5v4r-558c-254r

  OSV

• https://osv.dev/vulnerability/CGA-9w4r-68hh-64j5

  OSV

• https://osv.dev/vulnerability/CGA-4mmr-qwxr-f88g

  OSV

• https://osv.dev/vulnerability/CGA-m49h-wjp5-j434

  OSV

• https://osv.dev/vulnerability/CGA-mp43-q6p3-96v2

  OSV

• https://security.paloaltonetworks.com/PAN-SA-2024-0013
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-08
• https://github.com/h2o/h2o/commit/28fe15117b909588bf14269a0e1c6ec4548579fe

  Snyk

• https://security.alpinelinux.org/vuln/CVE-2023-44487

  OSV

• https://security-tracker.debian.org/tracker/CVE-2023-44487

  OSV

• https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause

  OSV · Third Party Advisory

• https://osv.dev/vulnerability/BIT-node-min-2023-44487

  OSV

• https://ubuntu.com/security/notices/USN-7067-1

  OSV

• https://github.com/grpc/grpc/releases/tag/v1.59.2

  CVE · Mailing List

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/

  CVE · vendor-advisory

• http://www.openwall.com/lists/oss-security/2023/10/10/7

  CVE · mailing-list

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/

  CVE · vendor-advisory

• http://www.openwall.com/lists/oss-security/2023/10/10/6

  OSV · Third Party Advisory · Mailing List

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI

  OSV · Mailing List

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX

  OSV · Mailing List

• https://ubuntu.com/security/notices/USN-7410-1

  OSV

• https://tomcat.apache.org/security-8.html

  OSV

• https://ubuntu.com/security/notices/USN-7469-1

  OSV

• https://ubuntu.com/security/notices/USN-7469-2

  OSV

• https://ubuntu.com/security/notices/USN-7469-3

  OSV

• https://ubuntu.com/security/notices/USN-7469-4

  OSV

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ

  CVE · Vendor Advisory

• https://docs.bell-sw.com/security/cves/CVE-2023-44487

  OSV

• https://osv.dev/vulnerability/BELL-CVE-2023-44487

  OSV

• https://osv.dev/vulnerability/DEBIAN-CVE-2023-44487

  OSV

• https://osv.dev/vulnerability/ALPINE-CVE-2023-44487

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487

  OSV · US Government Resource

• http://www.openwall.com/lists/oss-security/2025/08/13/6

  OSV · Third Party Advisory

• https://blog.powerdns.com/2024/02/16/powerdns-dnsdist-1.9.0-released

  OSV

• https://mailman.powerdns.com/pipermail/dnsdist/2023-October/001409.html

  OSV

• https://ubuntu.com/security/notices/USN-7892-1

  OSV

• https://osv.dev/vulnerability/JLSEC-2026-3

  OSV

• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2023-44487

  OSV

• https://cert-portal.siemens.com/productcert/html/ssa-341067.html

  NVD · Third Party Advisory

• https://cert-portal.siemens.com/productcert/html/ssa-082556.html

  NVD · Third Party Advisory

• https://cert-portal.siemens.com/productcert/html/ssa-784301.html

  NVD · Third Party Advisory

• https://cert-portal.siemens.com/productcert/html/ssa-915275.html

  NVD · Third Party Advisory

• https://cert-portal.siemens.com/productcert/html/ssa-832273.html

  NVD · Third Party Advisory

• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2023-44487

  OSV

• https://www.nginx.com/blog/

  CNNVD

• https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-

  CNNVD

• https://lists.w3.org/Archives/Public/ietf-

  CNNVD

• https://github.com/micrictor/

  CNNVD

• https://github.com/ng

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6581

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6484

  CNNVD

• https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6625

  CNNVD

• https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/

  CNNVD

• https://martinthomson.github.io/h2-stream-limits/draft-thomson-

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6130

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.7243

  CNNVD

• https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_

  CNNVD

• https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6249

  CNNVD

• https://seanmonstar.com/post/730794151136935936/hyper-

  CNNVD

• https://openssf.org/blog/2023/10/10/

  CNNVD

• https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-

  CNNVD

• https://arstechnica.com/security/2023/10/how-ddosers-used-the-

  CNNVD

• https://blog.cloudflare.com/zero-day-rapid-reset-

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.7197

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6047

  CNNVD

• https://forums.swift.org/t/swift-nio-

  CNNVD

• https://cxsecurity.com/cveshow/CVE-2023-44487/

  CNNVD

• https://github.com/akka/akka-

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6123

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.5978

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6310

  CNNVD

• https://github.com/kazu-yamamoto/

  CNNVD

• https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.7065

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6161

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6357

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6198

  CNNVD

• https://www.theregister.com/2023/10/10/

  CNNVD

• https://blog.cloudflare.com/technical-breakdown-

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6882

  CNNVD

• https://www.bleepingcomputer.com/news/security/new-

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.7260

  CNNVD

• https://blog.litespeedtech.com/2023/10/11/rapid-reset-

  CNNVD

• https://www.cisa.gov/news-events/alerts/2023/10/10/

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6851

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.5902

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6869

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6969

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6032

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.7223

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6831

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6315

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.7189

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6457

  CNNVD

• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2023-44487

  OSV