ghsa-qppj-fm5r-hxr3
CVSS 6.9 osv_maven
Description
## HTTP/2 Rapid reset attack The HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed. Abuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. The HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately. The ability to reset streams immediately allows each connection to have an indefinite number of requests in flight. By explicitly canceling the requests, the attacker never exceeds the limit on the number of concurrent open streams. The number of in-flight requests is no longer dependent on the round-trip time (RTT), but only on the available network bandwidth. In a typical HTTP/2 server implementation, the server will still have to do significant amounts of work for canceled requests, such as allocating new stream data structures, parsing the query and doing header decompression, and mapping the URL to a resource. For reverse proxy implementations, the request may be proxied to the backend server before the RST_STREAM frame is processed. The client on the other hand paid almost no costs for sending the requests. This creates an exploitable cost asymmetry between the server and the client. Multiple software artifacts implementing HTTP/2 are affected. This advisory was originally ingested from the `swift-nio-http2` repo advisory and their original conent follows. ## swift-nio-http2 specific advisory swift-nio-http2 is vulnerable to a denial-of-service vulnerability in which a malicious client can create and then reset a large number of HTTP/2 streams in a short period of time. This causes swift-nio-http2 to commit to a large amount of expensive work which it then throws away, including creating entirely new `Channel`s to serve the traffic. This can easily overwhelm an `EventLoop` and prevent it from making forward progress. swift-nio-http2 1.28 contains a remediation for this issue that applies reset counter using a sliding window. This constrains the number of stream resets that may occur in a given window of time. Clients violating this limit will have their connections torn down. This allows clients to continue to cancel streams for legitimate reasons, while constraining malicious actors.
Timeline
- Published
- unknown
- Last Modified
- unknown
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
References
- https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3
- https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf
- https://nvd.nist.gov/vuln/detail/CVE-2023-44487
- https://github.com/alibaba/tengine/issues/1872
- https://github.com/apache/apisix/issues/10320
- https://github.com/akka/akka-http/issues/4323
- https://github.com/varnishcache/varnish-cache/issues/3996
- https://github.com/tempesta-tech/tempesta/issues/1986
- https://github.com/Azure/AKS/issues/3947
- https://github.com/opensearch-project/data-prepper/issues/3474
- https://github.com/caddyserver/caddy/issues/5877
- https://github.com/openresty/openresty/issues/930
- https://github.com/dotnet/announcements/issues/277
- https://github.com/eclipse/jetty.project/issues/10679
- https://github.com/etcd-io/etcd/issues/16740
- https://github.com/golang/go/issues/63417
- https://github.com/ninenines/cowboy/issues/1615
- https://github.com/haproxy/haproxy/issues/2312
- https://github.com/hyperium/hyper/issues/3337
- https://github.com/kazu-yamamoto/http2/issues/93
- https://github.com/junkurihara/rust-rpxy/issues/97
- https://github.com/microsoft/CBL-Mariner/pull/6381
- https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632
- https://github.com/line/armeria/pull/5232
- https://github.com/kubernetes/kubernetes/pull/121120
- https://github.com/apache/httpd-site/pull/10
- https://github.com/projectcontour/contour/pull/5826
- https://github.com/apache/trafficserver/pull/10564
- https://github.com/nghttp2/nghttp2/pull/1961
- https://github.com/h2o/h2o/pull/3291
- https://github.com/grpc/grpc-go/pull/6703
- https://github.com/nodejs/node/pull/50121
- https://github.com/envoyproxy/envoy/pull/30055
- https://github.com/facebook/proxygen/pull/466
- https://github.com/akka/akka-http/pull/4325
- https://github.com/akka/akka-http/pull/4324
- https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
- https://github.com/apache/tomcat/commit/944332bb15bd2f3bf76ec2caeb1ff0a58a3bc628
- https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1
- https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5
- https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y
- https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ
- https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81
- https://ubuntu.com/security/CVE-2023-44487
- https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487
- https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
- https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event
- https://www.debian.org/security/2023/dsa-5521
- https://www.debian.org/security/2023/dsa-5522
- https://www.debian.org/security/2023/dsa-5540
- https://www.debian.org/security/2023/dsa-5549
- https://www.debian.org/security/2023/dsa-5558
- https://www.debian.org/security/2023/dsa-5570
- https://www.eclipse.org/lists/jetty-announce/msg00181.html
- https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487
- https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487
- https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products
- https://www.openwall.com/lists/oss-security/2023/10/10/6
- https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack
- https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday
- https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause
- https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487
- https://my.f5.com/manage/s/article/K000137106
- https://netty.io/news/2023/10/10/4-1-100-Final.html
- https://news.ycombinator.com/item?id=37830987
- https://news.ycombinator.com/item?id=37830998
- https://news.ycombinator.com/item?id=37831062
- https://news.ycombinator.com/item?id=37837043
- https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response
- https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ
- https://security.gentoo.org/glsa/202311-09
- https://security.netapp.com/advisory/ntap-20231016-0001
- https://security.netapp.com/advisory/ntap-20240426-0007
- https://security.netapp.com/advisory/ntap-20240621-0006
- https://security.netapp.com/advisory/ntap-20240621-0007
- https://security.paloaltonetworks.com/CVE-2023-44487
- https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14
- https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12
- https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94
- https://chaos.social/@icing/111210915918780532
- https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps
- https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack
- https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125
- https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715
- https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve
- https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764
- https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088
- https://github.com/Kong/kong/discussions/11741
- https://github.com/advisories/GHSA-qppj-fm5r-hxr3
- https://github.com/advisories/GHSA-vx74-f528-fxqg
- https://github.com/advisories/GHSA-xpw8-rcwv-8f8p
- https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113
- https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2
- https://github.com/apple/swift-nio-http2
- https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487
- https://github.com/bcdannyboy/CVE-2023-44487
- https://github.com/caddyserver/caddy/releases/tag/v2.7.5
- https://access.redhat.com/security/cve/cve-2023-44487
- https://akka.io/security/akka-http-cve-2023-44487.html
- https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size
- https://aws.amazon.com/security/security-bulletins/AWS-2023-011
- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack
- https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack
- https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty
- https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack
- https://blog.vespa.ai/cve-2023-44487
- https://bugzilla.proxmox.com/show_bug.cgi?id=4988
- https://bugzilla.redhat.com/show_bug.cgi?id=2242803
- https://bugzilla.suse.com/show_bug.cgi?id=1216123
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-341067.html
- https://cert-portal.siemens.com/productcert/html/ssa-784301.html
- https://cert-portal.siemens.com/productcert/html/ssa-832273.html
- https://cert-portal.siemens.com/productcert/html/ssa-915275.html
- https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9
- https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html
- https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html
- https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK
- https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73
- https://github.com/grpc/grpc-go/releases
- https://github.com/grpc/grpc/releases/tag/v1.59.2
- https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244
- https://github.com/micrictor/http2-rst-stream
- https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0
- https://github.com/oqtane/oqtane.framework/discussions/3367
- https://go.dev/cl/534215
- https://go.dev/cl/534235
- https://go.dev/issue/63417
- https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo
- https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ
- https://istio.io/latest/news/security/istio-security-2023-004
- https://linkerd.io/2023/10/12/linkerd-cve-2023-44487
- https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q
- https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html
- http://www.openwall.com/lists/oss-security/2023/10/10/6
- http://www.openwall.com/lists/oss-security/2023/10/10/7
- http://www.openwall.com/lists/oss-security/2023/10/13/4
- http://www.openwall.com/lists/oss-security/2023/10/13/9
- http://www.openwall.com/lists/oss-security/2023/10/18/4
- http://www.openwall.com/lists/oss-security/2023/10/18/8
- http://www.openwall.com/lists/oss-security/2023/10/19/6
- http://www.openwall.com/lists/oss-security/2023/10/20/8
- http://www.openwall.com/lists/oss-security/2025/08/13/6
Linked Vulnerabilities
No linked vulnerabilities found.
{
"affected": [
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "SwiftURL",
"name": "github.com/apple/swift-nio-http2",
"purl": "pkg:swift/github.com/apple/swift-nio-http2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.28.0"
}
],
"type": "SEMVER"
}
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Go",
"name": "golang.org/x/net",
"purl": "pkg:golang/golang.org/x/net"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.17.0"
}
],
"type": "SEMVER"
}
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-coyote",
"purl": "pkg:maven/org.apache.tomcat/tomcat-coyote"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0-M1"
},
{
"fixed": "11.0.0-M12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"11.0.0-M1",
"11.0.0-M10",
"11.0.0-M11",
"11.0.0-M3",
"11.0.0-M4",
"11.0.0-M5",
"11.0.0-M6",
"11.0.0-M7",
"11.0.0-M9"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-coyote",
"purl": "pkg:maven/org.apache.tomcat/tomcat-coyote"
},
"ranges": [
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.1.14"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.0.0",
"10.0.10",
"10.0.11",
"10.0.12",
"10.0.13",
"10.0.14",
"10.0.16",
"10.0.17",
"10.0.18",
"10.0.2",
"10.0.20",
"10.0.21",
"10.0.22",
"10.0.23",
"10.0.26",
"10.0.27",
"10.0.4",
"10.0.5",
"10.0.6",
"10.0.7",
"10.0.8",
"10.1.0",
"10.1.0-M1",
"10.1.0-M10",
"10.1.0-M11",
"10.1.0-M12",
"10.1.0-M14",
"10.1.0-M15",
"10.1.0-M16",
"10.1.0-M17",
"10.1.0-M2",
"10.1.0-M4",
"10.1.0-M5",
"10.1.0-M6",
"10.1.0-M7",
"10.1.0-M8",
"10.1.1",
"10.1.10",
"10.1.11",
"10.1.12",
"10.1.13",
"10.1.2",
"10.1.4",
"10.1.5",
"10.1.6",
"10.1.7",
"10.1.8",
"10.1.9"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-coyote",
"purl": "pkg:maven/org.apache.tomcat/tomcat-coyote"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.81"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"9.0.1",
"9.0.10",
"9.0.11",
"9.0.12",
"9.0.13",
"9.0.14",
"9.0.16",
"9.0.17",
"9.0.19",
"9.0.2",
"9.0.20",
"9.0.21",
"9.0.22",
"9.0.24",
"9.0.26",
"9.0.27",
"9.0.29",
"9.0.30",
"9.0.31",
"9.0.33",
"9.0.34",
"9.0.35",
"9.0.36",
"9.0.37",
"9.0.38",
"9.0.39",
"9.0.4",
"9.0.40",
"9.0.41",
"9.0.43",
"9.0.44",
"9.0.45",
"9.0.46",
"9.0.48",
"9.0.5",
"9.0.50",
"9.0.52",
"9.0.53",
"9.0.54",
"9.0.55",
"9.0.56",
"9.0.58",
"9.0.59",
"9.0.6",
"9.0.60",
"9.0.62",
"9.0.63",
"9.0.64",
"9.0.65",
"9.0.67",
"9.0.68",
"9.0.69",
"9.0.7",
"9.0.70",
"9.0.71",
"9.0.72",
"9.0.73",
"9.0.74",
"9.0.75",
"9.0.76",
"9.0.78",
"9.0.79",
"9.0.8",
"9.0.80"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-coyote",
"purl": "pkg:maven/org.apache.tomcat/tomcat-coyote"
},
"ranges": [
{
"events": [
{
"introduced": "8.5.0"
},
{
"fixed": "8.5.94"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8.5.0",
"8.5.11",
"8.5.12",
"8.5.13",
"8.5.14",
"8.5.15",
"8.5.16",
"8.5.19",
"8.5.2",
"8.5.20",
"8.5.21",
"8.5.23",
"8.5.24",
"8.5.27",
"8.5.28",
"8.5.29",
"8.5.3",
"8.5.30",
"8.5.31",
"8.5.32",
"8.5.33",
"8.5.34",
"8.5.35",
"8.5.37",
"8.5.38",
"8.5.39",
"8.5.4",
"8.5.40",
"8.5.41",
"8.5.42",
"8.5.43",
"8.5.45",
"8.5.46",
"8.5.47",
"8.5.49",
"8.5.5",
"8.5.50",
"8.5.51",
"8.5.53",
"8.5.54",
"8.5.55",
"8.5.56",
"8.5.57",
"8.5.58",
"8.5.59",
"8.5.6",
"8.5.60",
"8.5.61",
"8.5.63",
"8.5.64",
"8.5.65",
"8.5.66",
"8.5.68",
"8.5.69",
"8.5.70",
"8.5.71",
"8.5.72",
"8.5.73",
"8.5.75",
"8.5.76",
"8.5.77",
"8.5.78",
"8.5.79",
"8.5.8",
"8.5.81",
"8.5.82",
"8.5.83",
"8.5.84",
"8.5.85",
"8.5.86",
"8.5.87",
"8.5.88",
"8.5.89",
"8.5.9",
"8.5.90",
"8.5.91",
"8.5.92",
"8.5.93"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0-M1"
},
{
"fixed": "11.0.0-M12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"11.0.0-M1",
"11.0.0-M10",
"11.0.0-M11",
"11.0.0-M3",
"11.0.0-M4",
"11.0.0-M5",
"11.0.0-M6",
"11.0.0-M7",
"11.0.0-M9"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.1.14"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.0.0",
"10.0.10",
"10.0.11",
"10.0.12",
"10.0.13",
"10.0.14",
"10.0.16",
"10.0.17",
"10.0.18",
"10.0.2",
"10.0.20",
"10.0.21",
"10.0.22",
"10.0.23",
"10.0.26",
"10.0.27",
"10.0.4",
"10.0.5",
"10.0.6",
"10.0.7",
"10.0.8",
"10.1.0",
"10.1.0-M1",
"10.1.0-M10",
"10.1.0-M11",
"10.1.0-M12",
"10.1.0-M14",
"10.1.0-M15",
"10.1.0-M16",
"10.1.0-M17",
"10.1.0-M2",
"10.1.0-M4",
"10.1.0-M5",
"10.1.0-M6",
"10.1.0-M7",
"10.1.0-M8",
"10.1.1",
"10.1.10",
"10.1.11",
"10.1.12",
"10.1.13",
"10.1.2",
"10.1.4",
"10.1.5",
"10.1.6",
"10.1.7",
"10.1.8",
"10.1.9"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.81"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"9.0.1",
"9.0.10",
"9.0.11",
"9.0.12",
"9.0.13",
"9.0.14",
"9.0.16",
"9.0.17",
"9.0.19",
"9.0.2",
"9.0.20",
"9.0.21",
"9.0.22",
"9.0.24",
"9.0.26",
"9.0.27",
"9.0.29",
"9.0.30",
"9.0.31",
"9.0.33",
"9.0.34",
"9.0.35",
"9.0.36",
"9.0.37",
"9.0.38",
"9.0.39",
"9.0.4",
"9.0.40",
"9.0.41",
"9.0.43",
"9.0.44",
"9.0.45",
"9.0.46",
"9.0.48",
"9.0.5",
"9.0.50",
"9.0.52",
"9.0.53",
"9.0.54",
"9.0.55",
"9.0.56",
"9.0.58",
"9.0.59",
"9.0.6",
"9.0.60",
"9.0.62",
"9.0.63",
"9.0.64",
"9.0.65",
"9.0.67",
"9.0.68",
"9.0.69",
"9.0.7",
"9.0.70",
"9.0.71",
"9.0.72",
"9.0.73",
"9.0.74",
"9.0.75",
"9.0.76",
"9.0.78",
"9.0.79",
"9.0.8",
"9.0.80"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"events": [
{
"introduced": "8.5.0"
},
{
"fixed": "8.5.94"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8.5.0",
"8.5.11",
"8.5.12",
"8.5.13",
"8.5.14",
"8.5.15",
"8.5.16",
"8.5.19",
"8.5.2",
"8.5.20",
"8.5.21",
"8.5.23",
"8.5.24",
"8.5.27",
"8.5.28",
"8.5.29",
"8.5.3",
"8.5.30",
"8.5.31",
"8.5.32",
"8.5.33",
"8.5.34",
"8.5.35",
"8.5.37",
"8.5.38",
"8.5.39",
"8.5.4",
"8.5.40",
"8.5.41",
"8.5.42",
"8.5.43",
"8.5.45",
"8.5.46",
"8.5.47",
"8.5.49",
"8.5.5",
"8.5.50",
"8.5.51",
"8.5.53",
"8.5.54",
"8.5.55",
"8.5.56",
"8.5.57",
"8.5.58",
"8.5.59",
"8.5.6",
"8.5.60",
"8.5.61",
"8.5.63",
"8.5.64",
"8.5.65",
"8.5.66",
"8.5.68",
"8.5.69",
"8.5.70",
"8.5.71",
"8.5.72",
"8.5.73",
"8.5.75",
"8.5.76",
"8.5.77",
"8.5.78",
"8.5.79",
"8.5.8",
"8.5.81",
"8.5.82",
"8.5.83",
"8.5.84",
"8.5.85",
"8.5.86",
"8.5.87",
"8.5.88",
"8.5.89",
"8.5.9",
"8.5.90",
"8.5.91",
"8.5.92",
"8.5.93"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty.http2:http2-common",
"purl": "pkg:maven/org.eclipse.jetty.http2/http2-common"
},
"ranges": [
{
"events": [
{
"introduced": "9.3.0"
},
{
"fixed": "9.4.53"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"9.3.0.v20150612",
"9.3.1.v20150714",
"9.3.10.M0",
"9.3.10.v20160621",
"9.3.11.M0",
"9.3.11.v20160721",
"9.3.12.v20160915",
"9.3.13.M0",
"9.3.13.v20161014",
"9.3.14.v20161028",
"9.3.15.v20161220",
"9.3.16.v20170120",
"9.3.17.RC0",
"9.3.17.v20170317",
"9.3.18.v20170406",
"9.3.19.v20170502",
"9.3.2.v20150730",
"9.3.20.v20170531",
"9.3.21.M0",
"9.3.21.RC0",
"9.3.21.v20170918",
"9.3.22.v20171030",
"9.3.23.v20180228",
"9.3.24.v20180605",
"9.3.25.v20180904",
"9.3.26.v20190403",
"9.3.27.v20190418",
"9.3.28.v20191105",
"9.3.29.v20201019",
"9.3.3.v20150827",
"9.3.30.v20211001",
"9.3.4.RC0",
"9.3.4.RC1",
"9.3.4.v20151007",
"9.3.5.v20151012",
"9.3.6.v20151106",
"9.3.7.RC0",
"9.3.7.RC1",
"9.3.7.v20160115",
"9.3.8.RC0",
"9.3.8.v20160314",
"9.3.9.M0",
"9.3.9.M1",
"9.3.9.v20160517",
"9.4.0.M0",
"9.4.0.M1",
"9.4.0.RC0",
"9.4.0.RC1",
"9.4.0.RC2",
"9.4.0.RC3",
"9.4.0.v20161208",
"9.4.0.v20180619",
"9.4.1.v20170120",
"9.4.1.v20180619",
"9.4.10.RC0",
"9.4.10.RC1",
"9.4.10.v20180503",
"9.4.11.v20180605",
"9.4.12.RC0",
"9.4.12.RC1",
"9.4.12.RC2",
"9.4.12.v20180830",
"9.4.13.v20181111",
"9.4.14.v20181114",
"9.4.15.v20190215",
"9.4.16.v20190411",
"9.4.17.v20190418",
"9.4.18.v20190429",
"9.4.19.v20190610",
"9.4.2.v20170220",
"9.4.2.v20180619",
"9.4.20.v20190813",
"9.4.21.v20190926",
"9.4.22.v20191022",
"9.4.23.v20191118",
"9.4.24.v20191120",
"9.4.25.v20191220",
"9.4.26.v20200117",
"9.4.27.v20200227",
"9.4.28.v20200408",
"9.4.29.v20200521",
"9.4.3.v20170317",
"9.4.3.v20180619",
"9.4.30.v20200611",
"9.4.31.v20200723",
"9.4.32.v20200930",
"9.4.33.v20201020",
"9.4.34.v20201102",
"9.4.35.v20201120",
"9.4.36.v20210114",
"9.4.37.v20210219",
"9.4.38.v20210224",
"9.4.39.v20210325",
"9.4.4.v20170414",
"9.4.4.v20180619",
"9.4.40.v20210413",
"9.4.41.v20210516",
"9.4.42.v20210604",
"9.4.43.v20210629",
"9.4.44.v20210927",
"9.4.45.v20220203",
"9.4.46.v20220331",
"9.4.47.v20220610",
"9.4.48.v20220622",
"9.4.49.v20220914",
"9.4.5.v20170502",
"9.4.5.v20180619",
"9.4.50.v20221201",
"9.4.51.v20230217",
"9.4.52.v20230823",
"9.4.6.v20170531",
"9.4.6.v20180619",
"9.4.7.RC0",
"9.4.7.v20170914",
"9.4.7.v20180619",
"9.4.8.v20171121",
"9.4.8.v20180619",
"9.4.9.v20180320"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty.http2:http2-common",
"purl": "pkg:maven/org.eclipse.jetty.http2/http2-common"
},
"ranges": [
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.17"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.0.0",
"10.0.1",
"10.0.10",
"10.0.11",
"10.0.12",
"10.0.13",
"10.0.14",
"10.0.15",
"10.0.16",
"10.0.2",
"10.0.3",
"10.0.4",
"10.0.5",
"10.0.6",
"10.0.7",
"10.0.8",
"10.0.9"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty.http2:http2-common",
"purl": "pkg:maven/org.eclipse.jetty.http2/http2-common"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.0.17"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"11.0.0",
"11.0.1",
"11.0.10",
"11.0.11",
"11.0.12",
"11.0.13",
"11.0.14",
"11.0.15",
"11.0.16",
"11.0.2",
"11.0.3",
"11.0.4",
"11.0.5",
"11.0.6",
"11.0.7",
"11.0.8",
"11.0.9"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty.http2:http2-server",
"purl": "pkg:maven/org.eclipse.jetty.http2/http2-server"
},
"ranges": [
{
"events": [
{
"introduced": "9.3.0"
},
{
"fixed": "9.4.53"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"9.3.0.v20150612",
"9.3.1.v20150714",
"9.3.10.M0",
"9.3.10.v20160621",
"9.3.11.M0",
"9.3.11.v20160721",
"9.3.12.v20160915",
"9.3.13.M0",
"9.3.13.v20161014",
"9.3.14.v20161028",
"9.3.15.v20161220",
"9.3.16.v20170120",
"9.3.17.RC0",
"9.3.17.v20170317",
"9.3.18.v20170406",
"9.3.19.v20170502",
"9.3.2.v20150730",
"9.3.20.v20170531",
"9.3.21.M0",
"9.3.21.RC0",
"9.3.21.v20170918",
"9.3.22.v20171030",
"9.3.23.v20180228",
"9.3.24.v20180605",
"9.3.25.v20180904",
"9.3.26.v20190403",
"9.3.27.v20190418",
"9.3.28.v20191105",
"9.3.29.v20201019",
"9.3.3.v20150827",
"9.3.30.v20211001",
"9.3.4.RC0",
"9.3.4.RC1",
"9.3.4.v20151007",
"9.3.5.v20151012",
"9.3.6.v20151106",
"9.3.7.RC0",
"9.3.7.RC1",
"9.3.7.v20160115",
"9.3.8.RC0",
"9.3.8.v20160314",
"9.3.9.M0",
"9.3.9.M1",
"9.3.9.v20160517",
"9.4.0.M0",
"9.4.0.M1",
"9.4.0.RC0",
"9.4.0.RC1",
"9.4.0.RC2",
"9.4.0.RC3",
"9.4.0.v20161208",
"9.4.0.v20180619",
"9.4.1.v20170120",
"9.4.1.v20180619",
"9.4.10.RC0",
"9.4.10.RC1",
"9.4.10.v20180503",
"9.4.11.v20180605",
"9.4.12.RC0",
"9.4.12.RC1",
"9.4.12.RC2",
"9.4.12.v20180830",
"9.4.13.v20181111",
"9.4.14.v20181114",
"9.4.15.v20190215",
"9.4.16.v20190411",
"9.4.17.v20190418",
"9.4.18.v20190429",
"9.4.19.v20190610",
"9.4.2.v20170220",
"9.4.2.v20180619",
"9.4.20.v20190813",
"9.4.21.v20190926",
"9.4.22.v20191022",
"9.4.23.v20191118",
"9.4.24.v20191120",
"9.4.25.v20191220",
"9.4.26.v20200117",
"9.4.27.v20200227",
"9.4.28.v20200408",
"9.4.29.v20200521",
"9.4.3.v20170317",
"9.4.3.v20180619",
"9.4.30.v20200611",
"9.4.31.v20200723",
"9.4.32.v20200930",
"9.4.33.v20201020",
"9.4.34.v20201102",
"9.4.35.v20201120",
"9.4.36.v20210114",
"9.4.37.v20210219",
"9.4.38.v20210224",
"9.4.39.v20210325",
"9.4.4.v20170414",
"9.4.4.v20180619",
"9.4.40.v20210413",
"9.4.41.v20210516",
"9.4.42.v20210604",
"9.4.43.v20210629",
"9.4.44.v20210927",
"9.4.45.v20220203",
"9.4.46.v20220331",
"9.4.47.v20220610",
"9.4.48.v20220622",
"9.4.49.v20220914",
"9.4.5.v20170502",
"9.4.5.v20180619",
"9.4.50.v20221201",
"9.4.51.v20230217",
"9.4.52.v20230823",
"9.4.6.v20170531",
"9.4.6.v20180619",
"9.4.7.RC0",
"9.4.7.v20170914",
"9.4.7.v20180619",
"9.4.8.v20171121",
"9.4.8.v20180619",
"9.4.9.v20180320"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty.http2:http2-server",
"purl": "pkg:maven/org.eclipse.jetty.http2/http2-server"
},
"ranges": [
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.17"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.0.0",
"10.0.1",
"10.0.10",
"10.0.11",
"10.0.12",
"10.0.13",
"10.0.14",
"10.0.15",
"10.0.16",
"10.0.2",
"10.0.3",
"10.0.4",
"10.0.5",
"10.0.6",
"10.0.7",
"10.0.8",
"10.0.9"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty.http2:http2-server",
"purl": "pkg:maven/org.eclipse.jetty.http2/http2-server"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.0.17"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"11.0.0",
"11.0.1",
"11.0.10",
"11.0.11",
"11.0.12",
"11.0.13",
"11.0.14",
"11.0.15",
"11.0.16",
"11.0.2",
"11.0.3",
"11.0.4",
"11.0.5",
"11.0.6",
"11.0.7",
"11.0.8",
"11.0.9"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty.http2:jetty-http2-common",
"purl": "pkg:maven/org.eclipse.jetty.http2/jetty-http2-common"
},
"ranges": [
{
"events": [
{
"introduced": "12.0.0"
},
{
"fixed": "12.0.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"12.0.0",
"12.0.1"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.eclipse.jetty.http2:jetty-http2-server",
"purl": "pkg:maven/org.eclipse.jetty.http2/jetty-http2-server"
},
"ranges": [
{
"events": [
{
"introduced": "12.0.0"
},
{
"fixed": "12.0.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"12.0.0",
"12.0.1"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "com.typesafe.akka:akka-http-core",
"purl": "pkg:maven/com.typesafe.akka/akka-http-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.5.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.0.0-RC1"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "com.typesafe.akka:akka-http-core_2.13",
"purl": "pkg:maven/com.typesafe.akka/akka-http-core_2.13"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.5.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.1.10",
"10.1.11",
"10.1.12",
"10.1.13",
"10.1.14",
"10.1.15",
"10.1.8",
"10.1.9",
"10.2.0",
"10.2.0-M1",
"10.2.0-RC1",
"10.2.0-RC2",
"10.2.1",
"10.2.10",
"10.2.2",
"10.2.3",
"10.2.4",
"10.2.5",
"10.2.5-M1",
"10.2.5-M2",
"10.2.6",
"10.2.7",
"10.2.8",
"10.2.9",
"10.4.0",
"10.4.0-M1",
"10.4.0-M2",
"10.5.0",
"10.5.0-M1",
"10.5.1",
"10.5.2"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "com.typesafe.akka:akka-http-core_2.12",
"purl": "pkg:maven/com.typesafe.akka/akka-http-core_2.12"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.5.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.0.0",
"10.0.0-RC2",
"10.0.1",
"10.0.10",
"10.0.11",
"10.0.12",
"10.0.13",
"10.0.14",
"10.0.15",
"10.0.2",
"10.0.3",
"10.0.4",
"10.0.5",
"10.0.6",
"10.0.6+7-e2ba6752",
"10.0.7",
"10.0.8",
"10.0.9",
"10.1.0",
"10.1.0-RC1",
"10.1.0-RC2",
"10.1.1",
"10.1.10",
"10.1.11",
"10.1.12",
"10.1.13",
"10.1.14",
"10.1.15",
"10.1.2",
"10.1.3",
"10.1.4",
"10.1.5",
"10.1.6",
"10.1.7",
"10.1.8",
"10.1.9",
"10.2.0",
"10.2.0-M1",
"10.2.0-RC1",
"10.2.0-RC2",
"10.2.1",
"10.2.10",
"10.2.2",
"10.2.3",
"10.2.4",
"10.2.5",
"10.2.5-M1",
"10.2.5-M2",
"10.2.6",
"10.2.7",
"10.2.8",
"10.2.9",
"10.4.0",
"10.4.0-M1",
"10.4.0-M2",
"10.5.0",
"10.5.0-M1",
"10.5.1",
"10.5.2"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"
},
"package": {
"ecosystem": "Maven",
"name": "com.typesafe.akka:akka-http-core_2.11",
"purl": "pkg:maven/com.typesafe.akka/akka-http-core_2.11"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "10.1.15"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.0.0",
"10.0.0-RC2",
"10.0.1",
"10.0.10",
"10.0.11",
"10.0.12",
"10.0.13",
"10.0.14",
"10.0.15",
"10.0.2",
"10.0.3",
"10.0.4",
"10.0.5",
"10.0.6",
"10.0.6+7-e2ba6752",
"10.0.7",
"10.0.8",
"10.0.9",
"10.1.0",
"10.1.0-RC1",
"10.1.0-RC2",
"10.1.1",
"10.1.10",
"10.1.11",
"10.1.12",
"10.1.13",
"10.1.14",
"10.1.15",
"10.1.2",
"10.1.3",
"10.1.4",
"10.1.5",
"10.1.6",
"10.1.7",
"10.1.8",
"10.1.9",
"2.4-ARTERY-M1",
"2.4-ARTERY-M2",
"2.4-ARTERY-M3",
"2.4-ARTERY-M4",
"2.4.10",
"2.4.11",
"2.4.11.1",
"2.4.11.2",
"2.4.2",
"2.4.2-RC1",
"2.4.2-RC2",
"2.4.2-RC3",
"2.4.3",
"2.4.4",
"2.4.5",
"2.4.6",
"2.4.7",
"2.4.8",
"2.4.9",
"2.4.9-RC1",
"2.4.9-RC2",
"3.0.0-RC1"
]
}
],
"aliases": [
"BIT-apisix-2023-44487",
"BIT-aspnet-core-2023-44487",
"BIT-contour-2023-44487",
"BIT-dotnet-2023-44487",
"BIT-dotnet-sdk-2023-44487",
"BIT-envoy-2023-44487",
"BIT-golang-2023-44487",
"BIT-jenkins-2023-44487",
"BIT-kong-2023-44487",
"BIT-nginx-2023-44487",
"BIT-nginx-gateway-2023-44487",
"BIT-node-2023-44487",
"BIT-node-min-2023-44487",
"BIT-solr-2023-44487",
"BIT-tomcat-2023-44487",
"BIT-varnish-2023-44487",
"CVE-2023-44487"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-10T21:28:24Z",
"nvd_published_at": "2023-10-10T14:15:10Z",
"severity": "MODERATE"
},
"details": "## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight. By explicitly canceling the requests, the attacker never exceeds the limit on the number of concurrent open streams. The number of in-flight requests is no longer dependent on the round-trip time (RTT), but only on the available network bandwidth.\n\nIn a typical HTTP/2 server implementation, the server will still have to do significant amounts of work for canceled requests, such as allocating new stream data structures, parsing the query and doing header decompression, and mapping the URL to a resource. For reverse proxy implementations, the request may be proxied to the backend server before the RST_STREAM frame is processed. The client on the other hand paid almost no costs for sending the requests. This creates an exploitable cost asymmetry between the server and the client.\n\nMultiple software artifacts implementing HTTP/2 are affected. This advisory was originally ingested from the `swift-nio-http2` repo advisory and their original conent follows.\n\n## swift-nio-http2 specific advisory\nswift-nio-http2 is vulnerable to a denial-of-service vulnerability in which a malicious client can create and then reset a large number of HTTP/2 streams in a short period of time. This causes swift-nio-http2 to commit to a large amount of expensive work which it then throws away, including creating entirely new `Channel`s to serve the traffic. This can easily overwhelm an `EventLoop` and prevent it from making forward progress.\n\nswift-nio-http2 1.28 contains a remediation for this issue that applies reset counter using a sliding window. This constrains the number of stream resets that may occur in a given window of time. Clients violating this limit will have their connections torn down. This allows clients to continue to cancel streams for legitimate reasons, while constraining malicious actors.",
"id": "GHSA-qppj-fm5r-hxr3",
"modified": "2026-09-10T03:50:04.757558216Z",
"published": "2023-10-10T21:28:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3"
},
{
"type": "WEB",
"url": "https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487"
},
{
"type": "WEB",
"url": "https://github.com/alibaba/tengine/issues/1872"
},
{
"type": "WEB",
"url": "https://github.com/apache/apisix/issues/10320"
},
{
"type": "WEB",
"url": "https://github.com/akka/akka-http/issues/4323"
},
{
"type": "WEB",
"url": "https://github.com/varnishcache/varnish-cache/issues/3996"
},
{
"type": "WEB",
"url": "https://github.com/tempesta-tech/tempesta/issues/1986"
},
{
"type": "WEB",
"url": "https://github.com/Azure/AKS/issues/3947"
},
{
"type": "WEB",
"url": "https://github.com/opensearch-project/data-prepper/issues/3474"
},
{
"type": "WEB",
"url": "https://github.com/caddyserver/caddy/issues/5877"
},
{
"type": "WEB",
"url": "https://github.com/openresty/openresty/issues/930"
},
{
"type": "WEB",
"url": "https://github.com/dotnet/announcements/issues/277"
},
{
"type": "WEB",
"url": "https://github.com/eclipse/jetty.project/issues/10679"
},
{
"type": "WEB",
"url": "https://github.com/etcd-io/etcd/issues/16740"
},
{
"type": "WEB",
"url": "https://github.com/golang/go/issues/63417"
},
{
"type": "WEB",
"url": "https://github.com/ninenines/cowboy/issues/1615"
},
{
"type": "WEB",
"url": "https://github.com/haproxy/haproxy/issues/2312"
},
{
"type": "WEB",
"url": "https://github.com/hyperium/hyper/issues/3337"
},
{
"type": "WEB",
"url": "https://github.com/kazu-yamamoto/http2/issues/93"
},
{
"type": "WEB",
"url": "https://github.com/junkurihara/rust-rpxy/issues/97"
},
{
"type": "WEB",
"url": "https://github.com/microsoft/CBL-Mariner/pull/6381"
},
{
"type": "WEB",
"url": "https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632"
},
{
"type": "WEB",
"url": "https://github.com/line/armeria/pull/5232"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/pull/121120"
},
{
"type": "WEB",
"url": "https://github.com/apache/httpd-site/pull/10"
},
{
"type": "WEB",
"url": "https://github.com/projectcontour/contour/pull/5826"
},
{
"type": "WEB",
"url": "https://github.com/apache/trafficserver/pull/10564"
},
{
"type": "WEB",
"url": "https://github.com/nghttp2/nghttp2/pull/1961"
},
{
"type": "WEB",
"url": "https://github.com/h2o/h2o/pull/3291"
},
{
"type": "WEB",
"url": "https://github.com/grpc/grpc-go/pull/6703"
},
{
"type": "WEB",
"url": "https://github.com/nodejs/node/pull/50121"
},
{
"type": "WEB",
"url": "https://github.com/envoyproxy/envoy/pull/30055"
},
{
"type": "WEB",
"url": "https://github.com/facebook/proxygen/pull/466"
},
{
"type": "WEB",
"url": "https://github.com/akka/akka-http/pull/4325"
},
{
"type": "WEB",
"url": "https://github.com/akka/akka-http/pull/4324"
},
{
"type": "WEB",
"url": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/944332bb15bd2f3bf76ec2caeb1ff0a58a3bc628"
},
{
"type": "WEB",
"url": "https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1"
},
{
"type": "WEB",
"url": "https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5"
},
{
"type": "WEB",
"url": "https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y"
},
{
"type": "WEB",
"url": "https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81"
},
{
"type": "WEB",
"url": "https://ubuntu.com/security/CVE-2023-44487"
},
{
"type": "WEB",
"url": "https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487"
},
{
"type": "WEB",
"url": "https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5521"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5522"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5540"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5549"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5558"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5570"
},
{
"type": "WEB",
"url": "https://www.eclipse.org/lists/jetty-announce/msg00181.html"
},
{
"type": "WEB",
"url": "https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487"
},
{
"type": "WEB",
"url": "https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487"
},
{
"type": "WEB",
"url": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2023/10/10/6"
},
{
"type": "WEB",
"url": "https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack"
},
{
"type": "WEB",
"url": "https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday"
},
{
"type": "WEB",
"url": "https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487"
},
{
"type": "WEB",
"url": "https://my.f5.com/manage/s/article/K000137106"
},
{
"type": "WEB",
"url": "https://netty.io/news/2023/10/10/4-1-100-Final.html"
},
{
"type": "WEB",
"url": "https://news.ycombinator.com/item?id=37830987"
},
{
"type": "WEB",
"url": "https://news.ycombinator.com/item?id=37830998"
},
{
"type": "WEB",
"url": "https://news.ycombinator.com/item?id=37831062"
},
{
"type": "WEB",
"url": "https://news.ycombinator.com/item?id=37837043"
},
{
"type": "WEB",
"url": "https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response"
},
{
"type": "WEB",
"url": "https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202311-09"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20231016-0001"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240426-0007"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240621-0006"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240621-0007"
},
{
"type": "WEB",
"url": "https://security.paloaltonetworks.com/CVE-2023-44487"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94"
},
{
"type": "WEB",
"url": "https://chaos.social/@icing/111210915918780532"
},
{
"type": "WEB",
"url": "https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps"
},
{
"type": "WEB",
"url": "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack"
},
{
"type": "WEB",
"url": "https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715"
},
{
"type": "WEB",
"url": "https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve"
},
{
"type": "WEB",
"url": "https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764"
},
{
"type": "WEB",
"url": "https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088"
},
{
"type": "WEB",
"url": "https://github.com/Kong/kong/discussions/11741"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-qppj-fm5r-hxr3"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-vx74-f528-fxqg"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-xpw8-rcwv-8f8p"
},
{
"type": "WEB",
"url": "https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2"
},
{
"type": "PACKAGE",
"url": "https://github.com/apple/swift-nio-http2"
},
{
"type": "WEB",
"url": "https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487"
},
{
"type": "WEB",
"url": "https://github.com/bcdannyboy/CVE-2023-44487"
},
{
"type": "WEB",
"url": "https://github.com/caddyserver/caddy/releases/tag/v2.7.5"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/cve-2023-44487"
},
{
"type": "WEB",
"url": "https://akka.io/security/akka-http-cve-2023-44487.html"
},
{
"type": "WEB",
"url": "https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size"
},
{
"type": "WEB",
"url": "https://aws.amazon.com/security/security-bulletins/AWS-2023-011"
},
{
"type": "WEB",
"url": "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack"
},
{
"type": "WEB",
"url": "https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack"
},
{
"type": "WEB",
"url": "https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty"
},
{
"type": "WEB",
"url": "https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack"
},
{
"type": "WEB",
"url": "https://blog.vespa.ai/cve-2023-44487"
},
{
"type": "WEB",
"url": "https://bugzilla.proxmox.com/show_bug.cgi?id=4988"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1216123"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-341067.html"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784301.html"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-832273.html"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-915275.html"
},
{
"type": "WEB",
"url": "https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK"
},
{
"type": "WEB",
"url": "https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73"
},
{
"type": "WEB",
"url": "https://github.com/grpc/grpc-go/releases"
},
{
"type": "WEB",
"url": "https://github.com/grpc/grpc/releases/tag/v1.59.2"
},
{
"type": "WEB",
"url": "https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244"
},
{
"type": "WEB",
"url": "https://github.com/micrictor/http2-rst-stream"
},
{
"type": "WEB",
"url": "https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0"
},
{
"type": "WEB",
"url": "https://github.com/oqtane/oqtane.framework/discussions/3367"
},
{
"type": "WEB",
"url": "https://go.dev/cl/534215"
},
{
"type": "WEB",
"url": "https://go.dev/cl/534235"
},
{
"type": "WEB",
"url": "https://go.dev/issue/63417"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ"
},
{
"type": "WEB",
"url": "https://istio.io/latest/news/security/istio-security-2023-004"
},
{
"type": "WEB",
"url": "https://linkerd.io/2023/10/12/linkerd-cve-2023-44487"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/10/10/6"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/10/10/7"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/10/13/4"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/10/13/9"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/10/18/4"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/10/18/8"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/10/19/6"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/10/20/8"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/08/13/6"
}
],
"related": [
"CVE-2023-44487"
],
"schema_version": "1.9.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:A",
"type": "CVSS_V4"
}
],
"summary": "HTTP/2 Stream Cancellation Attack"
}