--- id: "CVE-2023-44487" kind: "vulnerability" aliases: ["CVE-2023-44487"] title: "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset\u2026" severity: "high" cvss: 7.5 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "IETF HTTP/2", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "siemens simatic s7-1500 cpu 1518f-4 pn\\/dp mfp firmware", "fixed": [], "affected": ">= 3.1.5", "ecosystem": "vendor"}, {"name": "siemens sinec ins", "fixed": ["1.0"], "affected": "< 1.0", "ecosystem": "vendor"}, {"name": "siemens sinec ins", "fixed": [], "affected": "= 1.0", "ecosystem": "vendor"}, {"name": "siemens sinec nms", "fixed": ["3.0"], "affected": "< 3.0", "ecosystem": "vendor"}, {"name": "siemens st7 scadaconnect", "fixed": ["1.1"], "affected": "< 1.1", "ecosystem": "vendor"}, {"name": "siemens ruggedcom ape1808 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "siemens simatic s7-1500 cpu 1518-4 pn\\/dp mfp firmware", "fixed": [], "affected": ">= 3.1.5", "ecosystem": "vendor"}, {"name": "siemens siplus s7-1500 cpu 1518-4 pn\\/dp mfp firmware", "fixed": [], "affected": ">= 3.1.5", "ecosystem": "vendor"}, {"name": "ietf http", "fixed": [], "affected": "= 2.0", "ecosystem": "vendor"}, {"name": "nghttp2", "fixed": ["1.57.0"], "affected": "< 1.57.0", "ecosystem": "vendor"}, {"name": "netty", "fixed": ["4.1.100"], "affected": "< 4.1.100", "ecosystem": "vendor"}, {"name": "envoyproxy envoy", "fixed": [], "affected": "= 1.24.10", "ecosystem": "vendor"}, {"name": "envoyproxy envoy", "fixed": [], "affected": "= 1.25.9", "ecosystem": "vendor"}, {"name": "envoyproxy envoy", "fixed": [], "affected": "= 1.26.4", "ecosystem": "vendor"}, {"name": "envoyproxy envoy", "fixed": [], "affected": "= 1.27.0", "ecosystem": "vendor"}, {"name": "eclipse jetty", "fixed": ["9.4.53"], "affected": "< 9.4.53", "ecosystem": "vendor"}, {"name": "eclipse jetty", "fixed": ["10.0.17"], "affected": ">= 10.0.0, < 10.0.17", "ecosystem": "vendor"}, {"name": "eclipse jetty", "fixed": ["11.0.17"], "affected": ">= 11.0.0, < 11.0.17", "ecosystem": "vendor"}, {"name": "eclipse jetty", "fixed": ["12.0.2"], "affected": ">= 12.0.0, < 12.0.2", "ecosystem": "vendor"}, {"name": "caddyserver caddy", "fixed": ["2.7.5"], "affected": "< 2.7.5", "ecosystem": "vendor"}, {"name": "golang go", "fixed": ["1.20.10"], "affected": "< 1.20.10", "ecosystem": "vendor"}, {"name": "golang go", "fixed": ["1.21.3"], "affected": ">= 1.21.0, < 1.21.3", "ecosystem": "vendor"}, {"name": "golang http2", "fixed": ["0.17.0"], "affected": "< 0.17.0", "ecosystem": "vendor"}, {"name": "golang networking", "fixed": ["0.17.0"], "affected": "< 0.17.0", "ecosystem": "vendor"}, {"name": "f5 big-ip access policy manager", "fixed": [], "affected": ">= 13.1.0, <= 13.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip access policy manager", "fixed": [], "affected": ">= 14.1.0, <= 14.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip access policy manager", "fixed": [], "affected": ">= 15.1.0, <= 15.1.10", "ecosystem": "vendor"}, {"name": "f5 big-ip access policy manager", "fixed": [], "affected": ">= 16.1.0, <= 16.1.4", "ecosystem": "vendor"}, {"name": "f5 big-ip access policy manager", "fixed": [], "affected": "= 17.1.0", "ecosystem": "vendor"}, {"name": "f5 big-ip advanced firewall manager", "fixed": [], "affected": ">= 13.1.0, <= 13.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip advanced firewall manager", "fixed": [], "affected": ">= 14.1.0, <= 14.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip advanced firewall manager", "fixed": [], "affected": ">= 15.1.0, <= 15.1.10", "ecosystem": "vendor"}, {"name": "f5 big-ip advanced firewall manager", "fixed": [], "affected": ">= 16.1.0, <= 16.1.4", "ecosystem": "vendor"}, {"name": "f5 big-ip advanced firewall manager", "fixed": [], "affected": "= 17.1.0", "ecosystem": "vendor"}, {"name": "f5 big-ip advanced web application firewall", "fixed": [], "affected": ">= 13.1.0, <= 13.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip advanced web application firewall", "fixed": [], "affected": ">= 14.1.0, <= 14.1.5", "ecosystem": "vendor"}, {"name": "f5 big-ip advanced web application firewall", "fixed": [], "affected": ">= 15.1.0, <= 15.1.10", "ecosystem": "vendor"}, {"name": "f5 big-ip advanced web application firewall", "fixed": [], "affected": ">= 16.1.0, <= 16.1.4", "ecosystem": "vendor"}, {"name": "f5 big-ip advanced web application firewall", "fixed": [], "affected": "= 17.1.0", "ecosystem": "vendor"}, {"name": "f5 big-ip analytics", "fixed": [], "affected": ">= 13.1.0, <= 13.1.5", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["cloud-services", "exploited", "http2", "infrastructure", "load-balancers", "reverse-proxies", "web-servers"] not_affected_if: ["http1-only", "no-http2-endpoint"] published_at: "2023-10-10T00:00:00+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-23T22:29:04+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-44487", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487", "first_seen_at": "2026-10-23T22:29:04+00:00"}] --- # The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset… HTTP/2 lets a client open and immediately cancel streams in rapid succession, forcing the server to do work for each one. An attacker can use this to knock web servers and proxies offline with a denial-of-service attack, and CISA reports it is being exploited in the wild. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:IETF HTTP/2 affected ? fixed ? - vendor:siemens simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware affected >= 3.1.5 fixed ? - vendor:siemens sinec ins affected < 1.0 fixed 1.0 - vendor:siemens sinec ins affected = 1.0 fixed ? - vendor:siemens sinec nms affected < 3.0 fixed 3.0 - vendor:siemens st7 scadaconnect affected < 1.1 fixed 1.1 - vendor:siemens ruggedcom ape1808 firmware affected ? fixed ? - vendor:siemens simatic s7-1500 cpu 1518-4 pn\/dp mfp firmware affected >= 3.1.5 fixed ? - vendor:siemens siplus s7-1500 cpu 1518-4 pn\/dp mfp firmware affected >= 3.1.5 fixed ? - vendor:ietf http affected = 2.0 fixed ? - vendor:nghttp2 affected < 1.57.0 fixed 1.57.0 - vendor:netty affected < 4.1.100 fixed 4.1.100 - vendor:envoyproxy envoy affected = 1.24.10 fixed ? - vendor:envoyproxy envoy affected = 1.25.9 fixed ? - vendor:envoyproxy envoy affected = 1.26.4 fixed ? - vendor:envoyproxy envoy affected = 1.27.0 fixed ? - vendor:eclipse jetty affected < 9.4.53 fixed 9.4.53 - vendor:eclipse jetty affected >= 10.0.0, < 10.0.17 fixed 10.0.17 - vendor:eclipse jetty affected >= 11.0.0, < 11.0.17 fixed 11.0.17 - vendor:eclipse jetty affected >= 12.0.0, < 12.0.2 fixed 12.0.2 - vendor:caddyserver caddy affected < 2.7.5 fixed 2.7.5 - vendor:golang go affected < 1.20.10 fixed 1.20.10 - vendor:golang go affected >= 1.21.0, < 1.21.3 fixed 1.21.3 - vendor:golang http2 affected < 0.17.0 fixed 0.17.0 - vendor:golang networking affected < 0.17.0 fixed 0.17.0 - vendor:f5 big-ip access policy manager affected >= 13.1.0, <= 13.1.5 fixed ? - vendor:f5 big-ip access policy manager affected >= 14.1.0, <= 14.1.5 fixed ? - vendor:f5 big-ip access policy manager affected >= 15.1.0, <= 15.1.10 fixed ? - vendor:f5 big-ip access policy manager affected >= 16.1.0, <= 16.1.4 fixed ? - vendor:f5 big-ip access policy manager affected = 17.1.0 fixed ? - vendor:f5 big-ip advanced firewall manager affected >= 13.1.0, <= 13.1.5 fixed ? - vendor:f5 big-ip advanced firewall manager affected >= 14.1.0, <= 14.1.5 fixed ? - vendor:f5 big-ip advanced firewall manager affected >= 15.1.0, <= 15.1.10 fixed ? - vendor:f5 big-ip advanced firewall manager affected >= 16.1.0, <= 16.1.4 fixed ? - vendor:f5 big-ip advanced firewall manager affected = 17.1.0 fixed ? - vendor:f5 big-ip advanced web application firewall affected >= 13.1.0, <= 13.1.5 fixed ? - vendor:f5 big-ip advanced web application firewall affected >= 14.1.0, <= 14.1.5 fixed ? - vendor:f5 big-ip advanced web application firewall affected >= 15.1.0, <= 15.1.10 fixed ? - vendor:f5 big-ip advanced web application firewall affected >= 16.1.0, <= 16.1.4 fixed ? - vendor:f5 big-ip advanced web application firewall affected = 17.1.0 fixed ? - vendor:f5 big-ip analytics affected >= 13.1.0, <= 13.1.5 fixed ? ## Fix Apply the vendor mitigations for your HTTP/2 server, proxy or load balancer, per CISA's required action; the sources do not name specific versions. If mitigations are unavailable, discontinue use of the affected product per CISA guidance. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-44487 - 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-44487 ## From the sources HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS). CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_