CVE-2023-44487

Key facts

CVSS score

7.5 (v3.1)

Severity

HIGH

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness (CWE)

CWE-400

EPSS score

100.0% (100th percentile)

In CISA KEV

Yes, added October 10, 2023

In EU EUVD

Yes (EUVD-2023-2795)

Published

October 10, 2023

NVD last modified

August 11, 2026

Status

Analyzed

Affected products

• akka / http server
• amazon / opensearch data prepper
• apache / apisix
• apache / solr
• apache / tomcat
• apache / tomcat
• apache / tomcat
• apache / tomcat
• apache / tomcat
• apache / tomcat
• apache / tomcat
• apache / tomcat
• apache / tomcat
• apache / tomcat
• apache / tomcat
• apache / tomcat
• apache / traffic server
• apple / swiftnio http/2
• caddyserver / caddy
• cisco / business process automation
• cisco / connected mobile experiences
• cisco / crosswork data gateway
• cisco / crosswork situation manager
• cisco / crosswork zero touch provisioning
• cisco / data center network manager
• cisco / enterprise chat and email
• cisco / expressway
• cisco / fog director
• cisco / ios xe
• cisco / ios xr
• cisco / iot field network director
• cisco / nexus 3016
• cisco / nexus 3016q
• cisco / nexus 3048
• cisco / nexus 3064
• cisco / nexus 3064-32t
• cisco / nexus 3064-t
• cisco / nexus 3064-x
• cisco / nexus 3064t
• cisco / nexus 3064x
• cisco / nexus 3100
• cisco / nexus 3100-v
• cisco / nexus 3100-z
• cisco / nexus 3100v
• cisco / nexus 31108pc-v
• cisco / nexus 31108pv-v
• cisco / nexus 31108tc-v
• cisco / nexus 31128pq
• cisco / nexus 3132c-z
• cisco / nexus 3132q

and 336 more…

Certified products that may be affected

61 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

• Red Hat Enterprise Linux 8 NSS Cryptographic Module - Red Hat, Inc. - FIPS 140 5513 - active
• Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, LLC - FIPS 140 5461 - active
• Red Hat Enterprise Linux 9 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5445 - active
• Red Hat Enterprise Linux 9 libgcrypt - Red Hat, Inc. - FIPS 140 5366 - active
• Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5089 - active

See all 61 in the Security Certifications Explorer.

References

• http://www.openwall.com/lists/oss-security/2023/10/10/6(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/10/10/7(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/10/13/4(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/10/13/9(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/10/18/4(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/10/18/8(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/10/19/6(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2023/10/20/8(Mailing List, Third Party Advisory)
• http://www.openwall.com/lists/oss-security/2025/08/13/6(Third Party Advisory)
• https://access.redhat.com/security/cve/cve-2023-44487(Vendor Advisory)
• https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/(Press/Media Coverage, Third Party Advisory)
• https://aws.amazon.com/security/security-bulletins/AWS-2023-011/(Third Party Advisory)
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/(Technical Description, Vendor Advisory)
• https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/(Third Party Advisory, Vendor Advisory)
• https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/(Vendor Advisory)
• https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack(Press/Media Coverage, Third Party Advisory)
• https://blog.vespa.ai/cve-2023-44487/(Vendor Advisory)
• https://bugzilla.proxmox.com/show_bug.cgi?id=4988(Issue Tracking, Third Party Advisory)
• https://bugzilla.redhat.com/show_bug.cgi?id=2242803(Issue Tracking, Vendor Advisory)
• https://bugzilla.suse.com/show_bug.cgi?id=1216123(Issue Tracking, Vendor Advisory)
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html(Third Party Advisory)
• https://cert-portal.siemens.com/productcert/html/ssa-341067.html(Third Party Advisory)
• https://cert-portal.siemens.com/productcert/html/ssa-784301.html(Third Party Advisory)
• https://cert-portal.siemens.com/productcert/html/ssa-832273.html(Third Party Advisory)
• https://cert-portal.siemens.com/productcert/html/ssa-915275.html(Third Party Advisory)
• https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9(Mailing List, Patch, Vendor Advisory)
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/(Technical Description, Vendor Advisory)
• https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack(Technical Description, Vendor Advisory)
• https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125(Vendor Advisory)
• https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715(Third Party Advisory)
• https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve(Broken Link)
• https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764(Vendor Advisory)
• https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088(Issue Tracking, Patch)
• https://github.com/Azure/AKS/issues/3947(Issue Tracking)
• https://github.com/Kong/kong/discussions/11741(Issue Tracking)
• https://github.com/advisories/GHSA-qppj-fm5r-hxr3(Vendor Advisory)
• https://github.com/advisories/GHSA-vx74-f528-fxqg(Mitigation, Patch, Vendor Advisory)
• https://github.com/advisories/GHSA-xpw8-rcwv-8f8p(Patch, Vendor Advisory)
• https://github.com/akka/akka-http/issues/4323(Issue Tracking)
• https://github.com/alibaba/tengine/issues/1872(Issue Tracking)