CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2023-44487
High (7.5) in IETF HTTP/2. In CISA KEV since 2023-10-10. EPSS 100% chance of exploitation in the next 30 days. Fixed in github.com/apple/swift-nio-http2 1.28.0.
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Severity
- EPSS
- 100% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2023-10-10, due 2023-10-31
- CWE
- CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Affected
- akka:http_server
- amazon:opensearch_data_prepper
- apache:apisix
- apache:solr
- apache:tomcat
- apache:traffic_server
- apple:swiftnio_http\/2
- caddyserver:caddy
- cisco:business_process_automation
- cisco:connected_mobile_experiences
- cisco:crosswork_data_gateway
- cisco:crosswork_situation_manager
- cisco:crosswork_zero_touch_provisioning
- cisco:data_center_network_manager
- cisco:enterprise_chat_and_email
- cisco:expressway
- cisco:fog_director
- cisco:ios_xe
- cisco:ios_xr
- cisco:iot_field_network_director
- cisco:nx-os
- cisco:prime_access_registrar
- cisco:prime_cable_provisioning
- cisco:prime_infrastructure
- cisco:prime_network_registrar
- cisco:secure_dynamic_attributes_connector
- cisco:secure_firewall_threat_defense
- cisco:secure_malware_analytics
- cisco:secure_web_appliance_firmware
- cisco:telepresence_video_communication_server
- cisco:ultra_cloud_core_-_policy_control_function
- cisco:ultra_cloud_core_-_serving_gateway_function
- cisco:ultra_cloud_core_-_session_management_function
- cisco:unified_attendant_console_advanced
- cisco:unified_contact_center_domain_manager
- cisco:unified_contact_center_enterprise
- cisco:unified_contact_center_enterprise_-_live_data_server
- cisco:unified_contact_center_management_portal
- debian:debian_linux
- dena:h2o
- eclipse:jetty
- envoyproxy:envoy
- f5:big-ip_access_policy_manager
- f5:big-ip_advanced_firewall_manager
- f5:big-ip_advanced_web_application_firewall
- f5:big-ip_analytics
- f5:big-ip_application_acceleration_manager
- f5:big-ip_application_security_manager
- f5:big-ip_application_visibility_and_reporting
- f5:big-ip_carrier-grade_nat
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qppj-fm5r-hxr3 | SwiftURL | github.com/apple/swift-nio-http2 | <1.28.0 | 1.28.0 |
| GHSA-qppj-fm5r-hxr3 | Go | golang.org/x/net | <0.17.0 | 0.17.0 |
| GHSA-qppj-fm5r-hxr3 | Maven | org.apache.tomcat:tomcat-coyote | >=11.0.0-M1 <11.0.0-M12 | 11.0.0-M12 |
| GHSA-qppj-fm5r-hxr3 | Maven | org.apache.tomcat:tomcat-coyote | >=10.0.0 <10.1.14 | 10.1.14 |
| GHSA-qppj-fm5r-hxr3 | Maven | org.apache.tomcat:tomcat-coyote | >=9.0.0 <9.0.81 | 9.0.81 |
| GHSA-qppj-fm5r-hxr3 | Maven | org.apache.tomcat:tomcat-coyote | >=8.5.0 <8.5.94 | 8.5.94 |
| GHSA-qppj-fm5r-hxr3 | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=11.0.0-M1 <11.0.0-M12 | 11.0.0-M12 |
| GHSA-qppj-fm5r-hxr3 | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=10.0.0 <10.1.14 | 10.1.14 |
| GHSA-qppj-fm5r-hxr3 | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=9.0.0 <9.0.81 | 9.0.81 |
| GHSA-qppj-fm5r-hxr3 | Maven | org.apache.tomcat.embed:tomcat-embed-core | >=8.5.0 <8.5.94 | 8.5.94 |
| GHSA-qppj-fm5r-hxr3 | Maven | org.eclipse.jetty.http2:http2-common | >=9.3.0 <9.4.53 | 9.4.53 |
| GHSA-qppj-fm5r-hxr3 | Maven | org.eclipse.jetty.http2:http2-common | >=10.0.0 <10.0.17 | 10.0.17 |
| GHSA-qppj-fm5r-hxr3 | Maven | org.eclipse.jetty.http2:http2-common | >=11.0.0 <11.0.17 | 11.0.17 |
| GHSA-qppj-fm5r-hxr3 | Maven | org.eclipse.jetty.http2:http2-server | >=9.3.0 <9.4.53 | 9.4.53 |
| GHSA-qppj-fm5r-hxr3 | Maven | org.eclipse.jetty.http2:http2-server | >=10.0.0 <10.0.17 | 10.0.17 |
| GHSA-qppj-fm5r-hxr3 | Maven | org.eclipse.jetty.http2:http2-server | >=11.0.0 <11.0.17 | 11.0.17 |
| GHSA-qppj-fm5r-hxr3 | Maven | org.eclipse.jetty.http2:jetty-http2-common | >=12.0.0 <12.0.2 | 12.0.2 |
| GHSA-qppj-fm5r-hxr3 | Maven | org.eclipse.jetty.http2:jetty-http2-server | >=12.0.0 <12.0.2 | 12.0.2 |
| GHSA-qppj-fm5r-hxr3 | Maven | com.typesafe.akka:akka-http-core | <10.5.3 | 10.5.3 |
| GHSA-qppj-fm5r-hxr3 | Maven | com.typesafe.akka:akka-http-core_2.13 | <10.5.3 | 10.5.3 |
| GHSA-qppj-fm5r-hxr3 | Maven | com.typesafe.akka:akka-http-core_2.12 | <10.5.3 | 10.5.3 |
| GHSA-qppj-fm5r-hxr3 | Maven | com.typesafe.akka:akka-http-core_2.11 | <=10.1.15 | no fix published |