{
  "affected": [
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "SwiftURL",
        "name": "github.com/apple/swift-nio-http2",
        "purl": "pkg:swift/github.com/apple/swift-nio-http2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.28.0"
            }
          ],
          "type": "SEMVER"
        }
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Go",
        "name": "golang.org/x/net",
        "purl": "pkg:golang/golang.org/x/net"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.17.0"
            }
          ],
          "type": "SEMVER"
        }
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat-coyote",
        "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-M1"
            },
            {
              "fixed": "11.0.0-M12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "11.0.0-M1",
        "11.0.0-M10",
        "11.0.0-M11",
        "11.0.0-M3",
        "11.0.0-M4",
        "11.0.0-M5",
        "11.0.0-M6",
        "11.0.0-M7",
        "11.0.0-M9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat-coyote",
        "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.1.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0",
        "10.0.10",
        "10.0.11",
        "10.0.12",
        "10.0.13",
        "10.0.14",
        "10.0.16",
        "10.0.17",
        "10.0.18",
        "10.0.2",
        "10.0.20",
        "10.0.21",
        "10.0.22",
        "10.0.23",
        "10.0.26",
        "10.0.27",
        "10.0.4",
        "10.0.5",
        "10.0.6",
        "10.0.7",
        "10.0.8",
        "10.1.0",
        "10.1.0-M1",
        "10.1.0-M10",
        "10.1.0-M11",
        "10.1.0-M12",
        "10.1.0-M14",
        "10.1.0-M15",
        "10.1.0-M16",
        "10.1.0-M17",
        "10.1.0-M2",
        "10.1.0-M4",
        "10.1.0-M5",
        "10.1.0-M6",
        "10.1.0-M7",
        "10.1.0-M8",
        "10.1.1",
        "10.1.10",
        "10.1.11",
        "10.1.12",
        "10.1.13",
        "10.1.2",
        "10.1.4",
        "10.1.5",
        "10.1.6",
        "10.1.7",
        "10.1.8",
        "10.1.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat-coyote",
        "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.81"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.0.1",
        "9.0.10",
        "9.0.11",
        "9.0.12",
        "9.0.13",
        "9.0.14",
        "9.0.16",
        "9.0.17",
        "9.0.19",
        "9.0.2",
        "9.0.20",
        "9.0.21",
        "9.0.22",
        "9.0.24",
        "9.0.26",
        "9.0.27",
        "9.0.29",
        "9.0.30",
        "9.0.31",
        "9.0.33",
        "9.0.34",
        "9.0.35",
        "9.0.36",
        "9.0.37",
        "9.0.38",
        "9.0.39",
        "9.0.4",
        "9.0.40",
        "9.0.41",
        "9.0.43",
        "9.0.44",
        "9.0.45",
        "9.0.46",
        "9.0.48",
        "9.0.5",
        "9.0.50",
        "9.0.52",
        "9.0.53",
        "9.0.54",
        "9.0.55",
        "9.0.56",
        "9.0.58",
        "9.0.59",
        "9.0.6",
        "9.0.60",
        "9.0.62",
        "9.0.63",
        "9.0.64",
        "9.0.65",
        "9.0.67",
        "9.0.68",
        "9.0.69",
        "9.0.7",
        "9.0.70",
        "9.0.71",
        "9.0.72",
        "9.0.73",
        "9.0.74",
        "9.0.75",
        "9.0.76",
        "9.0.78",
        "9.0.79",
        "9.0.8",
        "9.0.80"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat-coyote",
        "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.5.0"
            },
            {
              "fixed": "8.5.94"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.5.0",
        "8.5.11",
        "8.5.12",
        "8.5.13",
        "8.5.14",
        "8.5.15",
        "8.5.16",
        "8.5.19",
        "8.5.2",
        "8.5.20",
        "8.5.21",
        "8.5.23",
        "8.5.24",
        "8.5.27",
        "8.5.28",
        "8.5.29",
        "8.5.3",
        "8.5.30",
        "8.5.31",
        "8.5.32",
        "8.5.33",
        "8.5.34",
        "8.5.35",
        "8.5.37",
        "8.5.38",
        "8.5.39",
        "8.5.4",
        "8.5.40",
        "8.5.41",
        "8.5.42",
        "8.5.43",
        "8.5.45",
        "8.5.46",
        "8.5.47",
        "8.5.49",
        "8.5.5",
        "8.5.50",
        "8.5.51",
        "8.5.53",
        "8.5.54",
        "8.5.55",
        "8.5.56",
        "8.5.57",
        "8.5.58",
        "8.5.59",
        "8.5.6",
        "8.5.60",
        "8.5.61",
        "8.5.63",
        "8.5.64",
        "8.5.65",
        "8.5.66",
        "8.5.68",
        "8.5.69",
        "8.5.70",
        "8.5.71",
        "8.5.72",
        "8.5.73",
        "8.5.75",
        "8.5.76",
        "8.5.77",
        "8.5.78",
        "8.5.79",
        "8.5.8",
        "8.5.81",
        "8.5.82",
        "8.5.83",
        "8.5.84",
        "8.5.85",
        "8.5.86",
        "8.5.87",
        "8.5.88",
        "8.5.89",
        "8.5.9",
        "8.5.90",
        "8.5.91",
        "8.5.92",
        "8.5.93"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat.embed:tomcat-embed-core",
        "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-M1"
            },
            {
              "fixed": "11.0.0-M12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "11.0.0-M1",
        "11.0.0-M10",
        "11.0.0-M11",
        "11.0.0-M3",
        "11.0.0-M4",
        "11.0.0-M5",
        "11.0.0-M6",
        "11.0.0-M7",
        "11.0.0-M9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat.embed:tomcat-embed-core",
        "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.1.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0",
        "10.0.10",
        "10.0.11",
        "10.0.12",
        "10.0.13",
        "10.0.14",
        "10.0.16",
        "10.0.17",
        "10.0.18",
        "10.0.2",
        "10.0.20",
        "10.0.21",
        "10.0.22",
        "10.0.23",
        "10.0.26",
        "10.0.27",
        "10.0.4",
        "10.0.5",
        "10.0.6",
        "10.0.7",
        "10.0.8",
        "10.1.0",
        "10.1.0-M1",
        "10.1.0-M10",
        "10.1.0-M11",
        "10.1.0-M12",
        "10.1.0-M14",
        "10.1.0-M15",
        "10.1.0-M16",
        "10.1.0-M17",
        "10.1.0-M2",
        "10.1.0-M4",
        "10.1.0-M5",
        "10.1.0-M6",
        "10.1.0-M7",
        "10.1.0-M8",
        "10.1.1",
        "10.1.10",
        "10.1.11",
        "10.1.12",
        "10.1.13",
        "10.1.2",
        "10.1.4",
        "10.1.5",
        "10.1.6",
        "10.1.7",
        "10.1.8",
        "10.1.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat.embed:tomcat-embed-core",
        "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.81"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.0.1",
        "9.0.10",
        "9.0.11",
        "9.0.12",
        "9.0.13",
        "9.0.14",
        "9.0.16",
        "9.0.17",
        "9.0.19",
        "9.0.2",
        "9.0.20",
        "9.0.21",
        "9.0.22",
        "9.0.24",
        "9.0.26",
        "9.0.27",
        "9.0.29",
        "9.0.30",
        "9.0.31",
        "9.0.33",
        "9.0.34",
        "9.0.35",
        "9.0.36",
        "9.0.37",
        "9.0.38",
        "9.0.39",
        "9.0.4",
        "9.0.40",
        "9.0.41",
        "9.0.43",
        "9.0.44",
        "9.0.45",
        "9.0.46",
        "9.0.48",
        "9.0.5",
        "9.0.50",
        "9.0.52",
        "9.0.53",
        "9.0.54",
        "9.0.55",
        "9.0.56",
        "9.0.58",
        "9.0.59",
        "9.0.6",
        "9.0.60",
        "9.0.62",
        "9.0.63",
        "9.0.64",
        "9.0.65",
        "9.0.67",
        "9.0.68",
        "9.0.69",
        "9.0.7",
        "9.0.70",
        "9.0.71",
        "9.0.72",
        "9.0.73",
        "9.0.74",
        "9.0.75",
        "9.0.76",
        "9.0.78",
        "9.0.79",
        "9.0.8",
        "9.0.80"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat.embed:tomcat-embed-core",
        "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.5.0"
            },
            {
              "fixed": "8.5.94"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.5.0",
        "8.5.11",
        "8.5.12",
        "8.5.13",
        "8.5.14",
        "8.5.15",
        "8.5.16",
        "8.5.19",
        "8.5.2",
        "8.5.20",
        "8.5.21",
        "8.5.23",
        "8.5.24",
        "8.5.27",
        "8.5.28",
        "8.5.29",
        "8.5.3",
        "8.5.30",
        "8.5.31",
        "8.5.32",
        "8.5.33",
        "8.5.34",
        "8.5.35",
        "8.5.37",
        "8.5.38",
        "8.5.39",
        "8.5.4",
        "8.5.40",
        "8.5.41",
        "8.5.42",
        "8.5.43",
        "8.5.45",
        "8.5.46",
        "8.5.47",
        "8.5.49",
        "8.5.5",
        "8.5.50",
        "8.5.51",
        "8.5.53",
        "8.5.54",
        "8.5.55",
        "8.5.56",
        "8.5.57",
        "8.5.58",
        "8.5.59",
        "8.5.6",
        "8.5.60",
        "8.5.61",
        "8.5.63",
        "8.5.64",
        "8.5.65",
        "8.5.66",
        "8.5.68",
        "8.5.69",
        "8.5.70",
        "8.5.71",
        "8.5.72",
        "8.5.73",
        "8.5.75",
        "8.5.76",
        "8.5.77",
        "8.5.78",
        "8.5.79",
        "8.5.8",
        "8.5.81",
        "8.5.82",
        "8.5.83",
        "8.5.84",
        "8.5.85",
        "8.5.86",
        "8.5.87",
        "8.5.88",
        "8.5.89",
        "8.5.9",
        "8.5.90",
        "8.5.91",
        "8.5.92",
        "8.5.93"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.jetty.http2:http2-common",
        "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.3.0"
            },
            {
              "fixed": "9.4.53"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.3.0.v20150612",
        "9.3.1.v20150714",
        "9.3.10.M0",
        "9.3.10.v20160621",
        "9.3.11.M0",
        "9.3.11.v20160721",
        "9.3.12.v20160915",
        "9.3.13.M0",
        "9.3.13.v20161014",
        "9.3.14.v20161028",
        "9.3.15.v20161220",
        "9.3.16.v20170120",
        "9.3.17.RC0",
        "9.3.17.v20170317",
        "9.3.18.v20170406",
        "9.3.19.v20170502",
        "9.3.2.v20150730",
        "9.3.20.v20170531",
        "9.3.21.M0",
        "9.3.21.RC0",
        "9.3.21.v20170918",
        "9.3.22.v20171030",
        "9.3.23.v20180228",
        "9.3.24.v20180605",
        "9.3.25.v20180904",
        "9.3.26.v20190403",
        "9.3.27.v20190418",
        "9.3.28.v20191105",
        "9.3.29.v20201019",
        "9.3.3.v20150827",
        "9.3.30.v20211001",
        "9.3.4.RC0",
        "9.3.4.RC1",
        "9.3.4.v20151007",
        "9.3.5.v20151012",
        "9.3.6.v20151106",
        "9.3.7.RC0",
        "9.3.7.RC1",
        "9.3.7.v20160115",
        "9.3.8.RC0",
        "9.3.8.v20160314",
        "9.3.9.M0",
        "9.3.9.M1",
        "9.3.9.v20160517",
        "9.4.0.M0",
        "9.4.0.M1",
        "9.4.0.RC0",
        "9.4.0.RC1",
        "9.4.0.RC2",
        "9.4.0.RC3",
        "9.4.0.v20161208",
        "9.4.0.v20180619",
        "9.4.1.v20170120",
        "9.4.1.v20180619",
        "9.4.10.RC0",
        "9.4.10.RC1",
        "9.4.10.v20180503",
        "9.4.11.v20180605",
        "9.4.12.RC0",
        "9.4.12.RC1",
        "9.4.12.RC2",
        "9.4.12.v20180830",
        "9.4.13.v20181111",
        "9.4.14.v20181114",
        "9.4.15.v20190215",
        "9.4.16.v20190411",
        "9.4.17.v20190418",
        "9.4.18.v20190429",
        "9.4.19.v20190610",
        "9.4.2.v20170220",
        "9.4.2.v20180619",
        "9.4.20.v20190813",
        "9.4.21.v20190926",
        "9.4.22.v20191022",
        "9.4.23.v20191118",
        "9.4.24.v20191120",
        "9.4.25.v20191220",
        "9.4.26.v20200117",
        "9.4.27.v20200227",
        "9.4.28.v20200408",
        "9.4.29.v20200521",
        "9.4.3.v20170317",
        "9.4.3.v20180619",
        "9.4.30.v20200611",
        "9.4.31.v20200723",
        "9.4.32.v20200930",
        "9.4.33.v20201020",
        "9.4.34.v20201102",
        "9.4.35.v20201120",
        "9.4.36.v20210114",
        "9.4.37.v20210219",
        "9.4.38.v20210224",
        "9.4.39.v20210325",
        "9.4.4.v20170414",
        "9.4.4.v20180619",
        "9.4.40.v20210413",
        "9.4.41.v20210516",
        "9.4.42.v20210604",
        "9.4.43.v20210629",
        "9.4.44.v20210927",
        "9.4.45.v20220203",
        "9.4.46.v20220331",
        "9.4.47.v20220610",
        "9.4.48.v20220622",
        "9.4.49.v20220914",
        "9.4.5.v20170502",
        "9.4.5.v20180619",
        "9.4.50.v20221201",
        "9.4.51.v20230217",
        "9.4.52.v20230823",
        "9.4.6.v20170531",
        "9.4.6.v20180619",
        "9.4.7.RC0",
        "9.4.7.v20170914",
        "9.4.7.v20180619",
        "9.4.8.v20171121",
        "9.4.8.v20180619",
        "9.4.9.v20180320"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.jetty.http2:http2-common",
        "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0",
        "10.0.1",
        "10.0.10",
        "10.0.11",
        "10.0.12",
        "10.0.13",
        "10.0.14",
        "10.0.15",
        "10.0.16",
        "10.0.2",
        "10.0.3",
        "10.0.4",
        "10.0.5",
        "10.0.6",
        "10.0.7",
        "10.0.8",
        "10.0.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.jetty.http2:http2-common",
        "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0"
            },
            {
              "fixed": "11.0.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "11.0.0",
        "11.0.1",
        "11.0.10",
        "11.0.11",
        "11.0.12",
        "11.0.13",
        "11.0.14",
        "11.0.15",
        "11.0.16",
        "11.0.2",
        "11.0.3",
        "11.0.4",
        "11.0.5",
        "11.0.6",
        "11.0.7",
        "11.0.8",
        "11.0.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.jetty.http2:http2-server",
        "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.3.0"
            },
            {
              "fixed": "9.4.53"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.3.0.v20150612",
        "9.3.1.v20150714",
        "9.3.10.M0",
        "9.3.10.v20160621",
        "9.3.11.M0",
        "9.3.11.v20160721",
        "9.3.12.v20160915",
        "9.3.13.M0",
        "9.3.13.v20161014",
        "9.3.14.v20161028",
        "9.3.15.v20161220",
        "9.3.16.v20170120",
        "9.3.17.RC0",
        "9.3.17.v20170317",
        "9.3.18.v20170406",
        "9.3.19.v20170502",
        "9.3.2.v20150730",
        "9.3.20.v20170531",
        "9.3.21.M0",
        "9.3.21.RC0",
        "9.3.21.v20170918",
        "9.3.22.v20171030",
        "9.3.23.v20180228",
        "9.3.24.v20180605",
        "9.3.25.v20180904",
        "9.3.26.v20190403",
        "9.3.27.v20190418",
        "9.3.28.v20191105",
        "9.3.29.v20201019",
        "9.3.3.v20150827",
        "9.3.30.v20211001",
        "9.3.4.RC0",
        "9.3.4.RC1",
        "9.3.4.v20151007",
        "9.3.5.v20151012",
        "9.3.6.v20151106",
        "9.3.7.RC0",
        "9.3.7.RC1",
        "9.3.7.v20160115",
        "9.3.8.RC0",
        "9.3.8.v20160314",
        "9.3.9.M0",
        "9.3.9.M1",
        "9.3.9.v20160517",
        "9.4.0.M0",
        "9.4.0.M1",
        "9.4.0.RC0",
        "9.4.0.RC1",
        "9.4.0.RC2",
        "9.4.0.RC3",
        "9.4.0.v20161208",
        "9.4.0.v20180619",
        "9.4.1.v20170120",
        "9.4.1.v20180619",
        "9.4.10.RC0",
        "9.4.10.RC1",
        "9.4.10.v20180503",
        "9.4.11.v20180605",
        "9.4.12.RC0",
        "9.4.12.RC1",
        "9.4.12.RC2",
        "9.4.12.v20180830",
        "9.4.13.v20181111",
        "9.4.14.v20181114",
        "9.4.15.v20190215",
        "9.4.16.v20190411",
        "9.4.17.v20190418",
        "9.4.18.v20190429",
        "9.4.19.v20190610",
        "9.4.2.v20170220",
        "9.4.2.v20180619",
        "9.4.20.v20190813",
        "9.4.21.v20190926",
        "9.4.22.v20191022",
        "9.4.23.v20191118",
        "9.4.24.v20191120",
        "9.4.25.v20191220",
        "9.4.26.v20200117",
        "9.4.27.v20200227",
        "9.4.28.v20200408",
        "9.4.29.v20200521",
        "9.4.3.v20170317",
        "9.4.3.v20180619",
        "9.4.30.v20200611",
        "9.4.31.v20200723",
        "9.4.32.v20200930",
        "9.4.33.v20201020",
        "9.4.34.v20201102",
        "9.4.35.v20201120",
        "9.4.36.v20210114",
        "9.4.37.v20210219",
        "9.4.38.v20210224",
        "9.4.39.v20210325",
        "9.4.4.v20170414",
        "9.4.4.v20180619",
        "9.4.40.v20210413",
        "9.4.41.v20210516",
        "9.4.42.v20210604",
        "9.4.43.v20210629",
        "9.4.44.v20210927",
        "9.4.45.v20220203",
        "9.4.46.v20220331",
        "9.4.47.v20220610",
        "9.4.48.v20220622",
        "9.4.49.v20220914",
        "9.4.5.v20170502",
        "9.4.5.v20180619",
        "9.4.50.v20221201",
        "9.4.51.v20230217",
        "9.4.52.v20230823",
        "9.4.6.v20170531",
        "9.4.6.v20180619",
        "9.4.7.RC0",
        "9.4.7.v20170914",
        "9.4.7.v20180619",
        "9.4.8.v20171121",
        "9.4.8.v20180619",
        "9.4.9.v20180320"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.jetty.http2:http2-server",
        "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0",
        "10.0.1",
        "10.0.10",
        "10.0.11",
        "10.0.12",
        "10.0.13",
        "10.0.14",
        "10.0.15",
        "10.0.16",
        "10.0.2",
        "10.0.3",
        "10.0.4",
        "10.0.5",
        "10.0.6",
        "10.0.7",
        "10.0.8",
        "10.0.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.jetty.http2:http2-server",
        "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0"
            },
            {
              "fixed": "11.0.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "11.0.0",
        "11.0.1",
        "11.0.10",
        "11.0.11",
        "11.0.12",
        "11.0.13",
        "11.0.14",
        "11.0.15",
        "11.0.16",
        "11.0.2",
        "11.0.3",
        "11.0.4",
        "11.0.5",
        "11.0.6",
        "11.0.7",
        "11.0.8",
        "11.0.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.jetty.http2:jetty-http2-common",
        "purl": "pkg:maven/org.eclipse.jetty.http2/jetty-http2-common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.0.0"
            },
            {
              "fixed": "12.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "12.0.0",
        "12.0.1"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.jetty.http2:jetty-http2-server",
        "purl": "pkg:maven/org.eclipse.jetty.http2/jetty-http2-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.0.0"
            },
            {
              "fixed": "12.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "12.0.0",
        "12.0.1"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "com.typesafe.akka:akka-http-core",
        "purl": "pkg:maven/com.typesafe.akka/akka-http-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.0.0-RC1"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "com.typesafe.akka:akka-http-core_2.13",
        "purl": "pkg:maven/com.typesafe.akka/akka-http-core_2.13"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.1.10",
        "10.1.11",
        "10.1.12",
        "10.1.13",
        "10.1.14",
        "10.1.15",
        "10.1.8",
        "10.1.9",
        "10.2.0",
        "10.2.0-M1",
        "10.2.0-RC1",
        "10.2.0-RC2",
        "10.2.1",
        "10.2.10",
        "10.2.2",
        "10.2.3",
        "10.2.4",
        "10.2.5",
        "10.2.5-M1",
        "10.2.5-M2",
        "10.2.6",
        "10.2.7",
        "10.2.8",
        "10.2.9",
        "10.4.0",
        "10.4.0-M1",
        "10.4.0-M2",
        "10.5.0",
        "10.5.0-M1",
        "10.5.1",
        "10.5.2"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "com.typesafe.akka:akka-http-core_2.12",
        "purl": "pkg:maven/com.typesafe.akka/akka-http-core_2.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0",
        "10.0.0-RC2",
        "10.0.1",
        "10.0.10",
        "10.0.11",
        "10.0.12",
        "10.0.13",
        "10.0.14",
        "10.0.15",
        "10.0.2",
        "10.0.3",
        "10.0.4",
        "10.0.5",
        "10.0.6",
        "10.0.6+7-e2ba6752",
        "10.0.7",
        "10.0.8",
        "10.0.9",
        "10.1.0",
        "10.1.0-RC1",
        "10.1.0-RC2",
        "10.1.1",
        "10.1.10",
        "10.1.11",
        "10.1.12",
        "10.1.13",
        "10.1.14",
        "10.1.15",
        "10.1.2",
        "10.1.3",
        "10.1.4",
        "10.1.5",
        "10.1.6",
        "10.1.7",
        "10.1.8",
        "10.1.9",
        "10.2.0",
        "10.2.0-M1",
        "10.2.0-RC1",
        "10.2.0-RC2",
        "10.2.1",
        "10.2.10",
        "10.2.2",
        "10.2.3",
        "10.2.4",
        "10.2.5",
        "10.2.5-M1",
        "10.2.5-M2",
        "10.2.6",
        "10.2.7",
        "10.2.8",
        "10.2.9",
        "10.4.0",
        "10.4.0-M1",
        "10.4.0-M2",
        "10.5.0",
        "10.5.0-M1",
        "10.5.1",
        "10.5.2"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "com.typesafe.akka:akka-http-core_2.11",
        "purl": "pkg:maven/com.typesafe.akka/akka-http-core_2.11"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "10.1.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0",
        "10.0.0-RC2",
        "10.0.1",
        "10.0.10",
        "10.0.11",
        "10.0.12",
        "10.0.13",
        "10.0.14",
        "10.0.15",
        "10.0.2",
        "10.0.3",
        "10.0.4",
        "10.0.5",
        "10.0.6",
        "10.0.6+7-e2ba6752",
        "10.0.7",
        "10.0.8",
        "10.0.9",
        "10.1.0",
        "10.1.0-RC1",
        "10.1.0-RC2",
        "10.1.1",
        "10.1.10",
        "10.1.11",
        "10.1.12",
        "10.1.13",
        "10.1.14",
        "10.1.15",
        "10.1.2",
        "10.1.3",
        "10.1.4",
        "10.1.5",
        "10.1.6",
        "10.1.7",
        "10.1.8",
        "10.1.9",
        "2.4-ARTERY-M1",
        "2.4-ARTERY-M2",
        "2.4-ARTERY-M3",
        "2.4-ARTERY-M4",
        "2.4.10",
        "2.4.11",
        "2.4.11.1",
        "2.4.11.2",
        "2.4.2",
        "2.4.2-RC1",
        "2.4.2-RC2",
        "2.4.2-RC3",
        "2.4.3",
        "2.4.4",
        "2.4.5",
        "2.4.6",
        "2.4.7",
        "2.4.8",
        "2.4.9",
        "2.4.9-RC1",
        "2.4.9-RC2",
        "3.0.0-RC1"
      ]
    }
  ],
  "aliases": [
    "BIT-apisix-2023-44487",
    "BIT-aspnet-core-2023-44487",
    "BIT-contour-2023-44487",
    "BIT-dotnet-2023-44487",
    "BIT-dotnet-sdk-2023-44487",
    "BIT-envoy-2023-44487",
    "BIT-golang-2023-44487",
    "BIT-jenkins-2023-44487",
    "BIT-kong-2023-44487",
    "BIT-nginx-2023-44487",
    "BIT-nginx-gateway-2023-44487",
    "BIT-node-2023-44487",
    "BIT-node-min-2023-44487",
    "BIT-solr-2023-44487",
    "BIT-tomcat-2023-44487",
    "BIT-varnish-2023-44487",
    "CVE-2023-44487"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-10T21:28:24Z",
    "nvd_published_at": "2023-10-10T14:15:10Z",
    "severity": "MODERATE"
  },
  "details": "## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight. By explicitly canceling the requests, the attacker never exceeds the limit on the number of concurrent open streams. The number of in-flight requests is no longer dependent on the round-trip time (RTT), but only on the available network bandwidth.\n\nIn a typical HTTP/2 server implementation, the server will still have to do significant amounts of work for canceled requests, such as allocating new stream data structures, parsing the query and doing header decompression, and mapping the URL to a resource. For reverse proxy implementations, the request may be proxied to the backend server before the RST_STREAM frame is processed. The client on the other hand paid almost no costs for sending the requests. This creates an exploitable cost asymmetry between the server and the client.\n\nMultiple software artifacts implementing HTTP/2 are affected. This advisory was originally ingested from the `swift-nio-http2` repo advisory and their original conent follows.\n\n## swift-nio-http2 specific advisory\nswift-nio-http2 is vulnerable to a denial-of-service vulnerability in which a malicious client can create and then reset a large number of HTTP/2 streams in a short period of time. This causes swift-nio-http2 to commit to a large amount of expensive work which it then throws away, including creating entirely new `Channel`s to serve the traffic. This can easily overwhelm an `EventLoop` and prevent it from making forward progress.\n\nswift-nio-http2 1.28 contains a remediation for this issue that applies reset counter using a sliding window. This constrains the number of stream resets that may occur in a given window of time. Clients violating this limit will have their connections torn down. This allows clients to continue to cancel streams for legitimate reasons, while constraining malicious actors.",
  "id": "GHSA-qppj-fm5r-hxr3",
  "modified": "2026-09-10T03:50:04.757558216Z",
  "published": "2023-10-10T21:28:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alibaba/tengine/issues/1872"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/apisix/issues/10320"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akka/akka-http/issues/4323"
    },
    {
      "type": "WEB",
      "url": "https://github.com/varnishcache/varnish-cache/issues/3996"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tempesta-tech/tempesta/issues/1986"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Azure/AKS/issues/3947"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opensearch-project/data-prepper/issues/3474"
    },
    {
      "type": "WEB",
      "url": "https://github.com/caddyserver/caddy/issues/5877"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openresty/openresty/issues/930"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/announcements/issues/277"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eclipse/jetty.project/issues/10679"
    },
    {
      "type": "WEB",
      "url": "https://github.com/etcd-io/etcd/issues/16740"
    },
    {
      "type": "WEB",
      "url": "https://github.com/golang/go/issues/63417"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ninenines/cowboy/issues/1615"
    },
    {
      "type": "WEB",
      "url": "https://github.com/haproxy/haproxy/issues/2312"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hyperium/hyper/issues/3337"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kazu-yamamoto/http2/issues/93"
    },
    {
      "type": "WEB",
      "url": "https://github.com/junkurihara/rust-rpxy/issues/97"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/CBL-Mariner/pull/6381"
    },
    {
      "type": "WEB",
      "url": "https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632"
    },
    {
      "type": "WEB",
      "url": "https://github.com/line/armeria/pull/5232"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubernetes/kubernetes/pull/121120"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/httpd-site/pull/10"
    },
    {
      "type": "WEB",
      "url": "https://github.com/projectcontour/contour/pull/5826"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/trafficserver/pull/10564"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nghttp2/nghttp2/pull/1961"
    },
    {
      "type": "WEB",
      "url": "https://github.com/h2o/h2o/pull/3291"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grpc/grpc-go/pull/6703"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nodejs/node/pull/50121"
    },
    {
      "type": "WEB",
      "url": "https://github.com/envoyproxy/envoy/pull/30055"
    },
    {
      "type": "WEB",
      "url": "https://github.com/facebook/proxygen/pull/466"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akka/akka-http/pull/4325"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akka/akka-http/pull/4324"
    },
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/944332bb15bd2f3bf76ec2caeb1ff0a58a3bc628"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1"
    },
    {
      "type": "WEB",
      "url": "https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5"
    },
    {
      "type": "WEB",
      "url": "https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y"
    },
    {
      "type": "WEB",
      "url": "https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ"
    },
    {
      "type": "WEB",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81"
    },
    {
      "type": "WEB",
      "url": "https://ubuntu.com/security/CVE-2023-44487"
    },
    {
      "type": "WEB",
      "url": "https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487"
    },
    {
      "type": "WEB",
      "url": "https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2023/dsa-5521"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2023/dsa-5522"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2023/dsa-5540"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2023/dsa-5549"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2023/dsa-5558"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2023/dsa-5570"
    },
    {
      "type": "WEB",
      "url": "https://www.eclipse.org/lists/jetty-announce/msg00181.html"
    },
    {
      "type": "WEB",
      "url": "https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487"
    },
    {
      "type": "WEB",
      "url": "https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487"
    },
    {
      "type": "WEB",
      "url": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2023/10/10/6"
    },
    {
      "type": "WEB",
      "url": "https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack"
    },
    {
      "type": "WEB",
      "url": "https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday"
    },
    {
      "type": "WEB",
      "url": "https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487"
    },
    {
      "type": "WEB",
      "url": "https://my.f5.com/manage/s/article/K000137106"
    },
    {
      "type": "WEB",
      "url": "https://netty.io/news/2023/10/10/4-1-100-Final.html"
    },
    {
      "type": "WEB",
      "url": "https://news.ycombinator.com/item?id=37830987"
    },
    {
      "type": "WEB",
      "url": "https://news.ycombinator.com/item?id=37830998"
    },
    {
      "type": "WEB",
      "url": "https://news.ycombinator.com/item?id=37831062"
    },
    {
      "type": "WEB",
      "url": "https://news.ycombinator.com/item?id=37837043"
    },
    {
      "type": "WEB",
      "url": "https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response"
    },
    {
      "type": "WEB",
      "url": "https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202311-09"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20231016-0001"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20240426-0007"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20240621-0006"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20240621-0007"
    },
    {
      "type": "WEB",
      "url": "https://security.paloaltonetworks.com/CVE-2023-44487"
    },
    {
      "type": "WEB",
      "url": "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14"
    },
    {
      "type": "WEB",
      "url": "https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12"
    },
    {
      "type": "WEB",
      "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94"
    },
    {
      "type": "WEB",
      "url": "https://chaos.social/@icing/111210915918780532"
    },
    {
      "type": "WEB",
      "url": "https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps"
    },
    {
      "type": "WEB",
      "url": "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack"
    },
    {
      "type": "WEB",
      "url": "https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125"
    },
    {
      "type": "WEB",
      "url": "https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715"
    },
    {
      "type": "WEB",
      "url": "https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve"
    },
    {
      "type": "WEB",
      "url": "https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Kong/kong/discussions/11741"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-qppj-fm5r-hxr3"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-vx74-f528-fxqg"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-xpw8-rcwv-8f8p"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apple/swift-nio-http2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bcdannyboy/CVE-2023-44487"
    },
    {
      "type": "WEB",
      "url": "https://github.com/caddyserver/caddy/releases/tag/v2.7.5"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/cve-2023-44487"
    },
    {
      "type": "WEB",
      "url": "https://akka.io/security/akka-http-cve-2023-44487.html"
    },
    {
      "type": "WEB",
      "url": "https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size"
    },
    {
      "type": "WEB",
      "url": "https://aws.amazon.com/security/security-bulletins/AWS-2023-011"
    },
    {
      "type": "WEB",
      "url": "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack"
    },
    {
      "type": "WEB",
      "url": "https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack"
    },
    {
      "type": "WEB",
      "url": "https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty"
    },
    {
      "type": "WEB",
      "url": "https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack"
    },
    {
      "type": "WEB",
      "url": "https://blog.vespa.ai/cve-2023-44487"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.proxmox.com/show_bug.cgi?id=4988"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1216123"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-341067.html"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-784301.html"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-832273.html"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-915275.html"
    },
    {
      "type": "WEB",
      "url": "https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grpc/grpc-go/releases"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grpc/grpc/releases/tag/v1.59.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244"
    },
    {
      "type": "WEB",
      "url": "https://github.com/micrictor/http2-rst-stream"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oqtane/oqtane.framework/discussions/3367"
    },
    {
      "type": "WEB",
      "url": "https://go.dev/cl/534215"
    },
    {
      "type": "WEB",
      "url": "https://go.dev/cl/534235"
    },
    {
      "type": "WEB",
      "url": "https://go.dev/issue/63417"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ"
    },
    {
      "type": "WEB",
      "url": "https://istio.io/latest/news/security/istio-security-2023-004"
    },
    {
      "type": "WEB",
      "url": "https://linkerd.io/2023/10/12/linkerd-cve-2023-44487"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/10/10/6"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/10/10/7"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/10/13/4"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/10/13/9"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/10/18/4"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/10/18/8"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/10/19/6"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/10/20/8"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2025/08/13/6"
    }
  ],
  "related": [
    "CVE-2023-44487"
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:A",
      "type": "CVSS_V4"
    }
  ],
  "summary": "HTTP/2 Stream Cancellation Attack"
}