Skip to main content

Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

© 2026 Mondoo, Inc.

Privacy Policy Terms of Service Imprint

Vulnerability Intelligence

Vulnerability IntelligenceCVE-2023-44487

CVE-2023-44487

HIGH7.5

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023

Published Oct 10, 2023

Modified 2 months ago

Details

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

References(169)

WEBhttp://www.openwall.com/lists/oss-security/2023/10/10/6 WEBhttp://www.openwall.com/lists/oss-security/2023/10/10/7 WEBhttp://www.openwall.com/lists/oss-security/2023/10/13/4 WEBhttp://www.openwall.com/lists/oss-security/2023/10/13/9 WEBhttp://www.openwall.com/lists/oss-security/2023/10/18/4 WEBhttp://www.openwall.com/lists/oss-security/2023/10/18/8 WEBhttp://www.openwall.com/lists/oss-security/2023/10/19/6 WEBhttp://www.openwall.com/lists/oss-security/2023/10/20/8 WEBhttp://www.openwall.com/lists/oss-security/2025/08/13/6 WEBhttps://access.redhat.com/security/cve/cve-2023-44487 WEBhttps://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/WEBhttps://aws.amazon.com/security/security-bulletins/AWS-2023-011/WEBhttps://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/WEBhttps://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/WEBhttps://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/WEBhttps://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack WEBhttps://blog.vespa.ai/cve-2023-44487/WEBhttps://bugzilla.proxmox.com/show_bug.cgi?id=4988 WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=2242803 WEBhttps://bugzilla.suse.com/show_bug.cgi?id=1216123 WEBhttps://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 WEBhttps://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/WEBhttps://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack WEBhttps://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125 WEBhttps://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Ecosystems

Timeline

PublishedOct 10, 2023

ModifiedNov 4, 2025

CVE-2023-44487 | Mondoo Vulnerability Intelligence