{"id":"CVE-2023-44487","kind":"vulnerability","aliases":["CVE-2023-44487"],"related":[],"title":"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset…","description":"HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"HTTP/2 lets a client open and immediately cancel streams in rapid succession, forcing the server to do work for each one. An attacker can use this to knock web servers and proxies offline with a denial-of-service attack, and CISA reports it is being exploited in the wild.","severity":"high","cvss":7.5,"epss":null,"exploited":true,"exploited_at":"2023-10-10T00:00:00+00:00","products":[{"name":"IETF HTTP/2","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"siemens simatic s7-1500 cpu 1518f-4 pn\\/dp mfp firmware","fixed":[],"affected":">= 3.1.5","ecosystem":"vendor"},{"name":"siemens sinec ins","fixed":["1.0"],"affected":"< 1.0","ecosystem":"vendor"},{"name":"siemens sinec ins","fixed":[],"affected":"= 1.0","ecosystem":"vendor"},{"name":"siemens sinec nms","fixed":["3.0"],"affected":"< 3.0","ecosystem":"vendor"},{"name":"siemens st7 scadaconnect","fixed":["1.1"],"affected":"< 1.1","ecosystem":"vendor"},{"name":"siemens ruggedcom ape1808 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"siemens simatic s7-1500 cpu 1518-4 pn\\/dp mfp firmware","fixed":[],"affected":">= 3.1.5","ecosystem":"vendor"},{"name":"siemens siplus s7-1500 cpu 1518-4 pn\\/dp mfp firmware","fixed":[],"affected":">= 3.1.5","ecosystem":"vendor"},{"name":"ietf http","fixed":[],"affected":"= 2.0","ecosystem":"vendor"},{"name":"nghttp2","fixed":["1.57.0"],"affected":"< 1.57.0","ecosystem":"vendor"},{"name":"netty","fixed":["4.1.100"],"affected":"< 4.1.100","ecosystem":"vendor"},{"name":"envoyproxy envoy","fixed":[],"affected":"= 1.24.10","ecosystem":"vendor"},{"name":"envoyproxy envoy","fixed":[],"affected":"= 1.25.9","ecosystem":"vendor"},{"name":"envoyproxy envoy","fixed":[],"affected":"= 1.26.4","ecosystem":"vendor"},{"name":"envoyproxy envoy","fixed":[],"affected":"= 1.27.0","ecosystem":"vendor"},{"name":"eclipse jetty","fixed":["9.4.53"],"affected":"< 9.4.53","ecosystem":"vendor"},{"name":"eclipse jetty","fixed":["10.0.17"],"affected":">= 10.0.0, < 10.0.17","ecosystem":"vendor"},{"name":"eclipse jetty","fixed":["11.0.17"],"affected":">= 11.0.0, < 11.0.17","ecosystem":"vendor"},{"name":"eclipse jetty","fixed":["12.0.2"],"affected":">= 12.0.0, < 12.0.2","ecosystem":"vendor"},{"name":"caddyserver caddy","fixed":["2.7.5"],"affected":"< 2.7.5","ecosystem":"vendor"},{"name":"golang go","fixed":["1.20.10"],"affected":"< 1.20.10","ecosystem":"vendor"},{"name":"golang go","fixed":["1.21.3"],"affected":">= 1.21.0, < 1.21.3","ecosystem":"vendor"},{"name":"golang http2","fixed":["0.17.0"],"affected":"< 0.17.0","ecosystem":"vendor"},{"name":"golang networking","fixed":["0.17.0"],"affected":"< 0.17.0","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":[],"affected":">= 14.1.0, <= 14.1.5","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":[],"affected":">= 15.1.0, <= 15.1.10","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":[],"affected":">= 16.1.0, <= 16.1.4","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":[],"affected":"= 17.1.0","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":[],"affected":">= 14.1.0, <= 14.1.5","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":[],"affected":">= 15.1.0, <= 15.1.10","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":[],"affected":">= 16.1.0, <= 16.1.4","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":[],"affected":"= 17.1.0","ecosystem":"vendor"},{"name":"f5 big-ip advanced web application firewall","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"},{"name":"f5 big-ip advanced web application firewall","fixed":[],"affected":">= 14.1.0, <= 14.1.5","ecosystem":"vendor"},{"name":"f5 big-ip advanced web application firewall","fixed":[],"affected":">= 15.1.0, <= 15.1.10","ecosystem":"vendor"},{"name":"f5 big-ip advanced web application firewall","fixed":[],"affected":">= 16.1.0, <= 16.1.4","ecosystem":"vendor"},{"name":"f5 big-ip advanced web application firewall","fixed":[],"affected":"= 17.1.0","ecosystem":"vendor"},{"name":"f5 big-ip analytics","fixed":[],"affected":">= 13.1.0, <= 13.1.5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloud-services","exploited","http2","infrastructure","load-balancers","reverse-proxies","web-servers"],"not_affected_if":["http1-only","no-http2-endpoint"],"how_to_check":null,"fix":"Apply the vendor mitigations for your HTTP/2 server, proxy or load balancer, per CISA's required action; the sources do not name specific versions.\nIf mitigations are unavailable, discontinue use of the affected product per CISA guidance.","status":"open","published_at":"2023-10-10T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:04:28+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:04:28Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations for your HTTP/2 server, proxy or load balancer, per CISA's required action; the sources do not name specific versions.\nIf mitigations are unavailable, discontinue use of the affected product per CISA guidance.","reach":"internet","impact":"medium","summary":"HTTP/2 lets a client open and immediately cancel streams in rapid succession, forcing the server to do work for each one. An attacker can use this to knock web servers and proxies offline with a denial-of-service attack, and CISA reports it is being exploited in the wild.","category":"infrastructure","who_cares":["http2","web-servers","load-balancers","reverse-proxies","cloud-services"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker takes web services offline through resource exhaustion denial of service.","analyst_note":"Find vendor-specific affected and fixed versions and mitigation settings for common HTTP/2 servers and CDNs, starting from the CISA KEV entry and the vendor advisories it links to.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["http1-only","no-http2-endpoint"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000505,"input_tokens":2828,"output_tokens":444,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':313C '-1500':28A,55A,66A '-2023':18A,21A '-4':31A,58A,69A '-44487':19A,22A '/dp':33A,60A,71A '1518':57A,68A '1518f':30A '22':312C 'access':108A,115A,122A,129A,136A 'action':303C 'advanced':143A,150A,157A,164A,171A,178A,186A,194A,202A,210A 'allow':4A,291C 'analytics':218A 'ape1808':50A 'appli':304C 'applic':310C 'application':180A,188A,196A,204A,212A 'attack':256B,273B,299C 'balanc':227B 'big':106A,113A,120A,127A,134A,141A,148A,155A,162A,169A,176A,184A,192A,200A,208A,216A 'big-ip':105A,112A,119A,126A,133A,140A,147A,154A,161A,168A,175A,183A,191A,199A,207A,215A 'bod':311C 'caddy':95A 'caddyserver':94A 'cancel':14A,241B 'cisa':275B,301C 'client':237B 'cloud':220B,316C 'cloud-servic':219B 'consumpt':11A 'contain':285C 'cpu':29A,56A,67A 'cve':17A,20A 'ddos':300C 'denial':6A,270B,296C 'denial-of-servic':269B,295C 'discontinu':319C 'distribut':294C 'eclipse':86A,88A,90A,92A 'envoy':79A,81A,83A,85A 'envoyproxy':78A,80A,82A,84A 'exploit':222B,280B 'f5':104A,111A,118A,125A,132A,139A,146A,153A,160A,167A,174A,182A,190A,198A,206A,214A 'firewall':144A,151A,158A,165A,172A,181A,189A,197A,205A,213A 'firmware':35A,51A,62A,73A 'follow':309C 'forc':246B 'go':97A,99A 'golang':96A,98A,100A,102A 'guidanc':314C 'http':75A 'http/2':2A,24A,234B,284C 'http2':101A,223B 'ietf':23A,74A 'immedi':240B 'infrastructur':224B 'ins':38A,41A 'instruct':308C 'ip':107A,114A,121A,128A,135A,142A,149A,156A,163A,170A,177A,185A,193A,201A,209A,217A 'jetty':87A,89A,91A,93A 'knock':261B 'let':235B 'load':226B 'load-balanc':225B 'manager':110A,117A,124A,131A,138A,145A,152A,159A,166A,173A 'mfp':34A,61A,72A 'mitig':305C,325C 'netty':77A 'networking':103A 'nghttp2':76A 'nms':44A 'offlin':266B 'one':254B 'open':238B 'per':306C 'pn':32A,59A,70A 'policy':109A,116A,123A,130A,137A 'product':323C 'protocol':3A 'proxi':230B,265B 'rapid':244B,287C 'report':276B 'request':13A 'requir':302C 'reset':16A,288C 'resourc':10A 'revers':229B 'reverse-proxi':228B 'ruggedcom':49A 's7':27A,54A,65A 'scadaconnect':47A 'server':9A,233B,248B,263B 'servic':8A,221B,272B,298C,317C 'siemens':25A,36A,39A,42A,45A,48A,52A,63A 'simatic':26A,53A 'sinec':37A,40A,43A 'siplus':64A 'st7':46A 'stream':242B 'success':245B 'unavail':327C 'use':258B,320C 'vendor':307C 'vulner':289C 'web':179A,187A,195A,203A,211A,232B,262B 'web-serv':231B 'wild':283B 'work':251B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-10-10T00:00:00+00:00","kev":{"dateAdded":"2023-10-10","dueDate":"2023-10-31","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-44487","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-44487","severity":null,"published_at":"2023-10-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:41+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-44487","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","severity":null,"published_at":"2023-10-10T14:15:10+00:00","modified_at":"2026-08-11T19:37:30+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}