HTTP/2 Rapid Reset Attack Vulnerability
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
What happened
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CISA lists it as exploited, added 10 Oct 2023.
Does it affect you
Names Red Hat Enterprise Linux, Cisco IOS XE. Enter the product and version you run to place it against the affected range the vendor published.
What to do
- Follow the vendor advisory for the fixed release and any interim mitigation.
access.redhat.com - Follow the vendor advisory for the fixed release and any interim mitigation.
blog.cloudflare.com - Follow the vendor advisory for the fixed release and any interim mitigation.
blog.cloudflare.com - Follow the vendor advisory for the fixed release and any interim mitigation.
blog.litespeedtech.com - Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
cisa.gov
CISA’s notes for this entry:
- This vulnerability affects a common open-source component, third-party library, or protocol used by different products. For more information, please see: HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 | CISA: cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
- blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
- nvd.nist.gov/vuln/detail/CVE-2023-44487
Affected, as published to NVD
- rhel
- Red Hat Enterprise Linux: exactly 6.0
- cisco-iosxe
- Cisco IOS XE: everything below 17.15.1
The record
- NVD status
- Analyzed
- Published
- 10 Oct 2023, last modified 11 Aug 2026 (NVD)
- Severity
- CVSS 3.1 base score 7.5, High — computed here from the vector; NVD states 7.5.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness
- CWE-400 Uncontrolled Resource Consumption (NVD; names by MITRE)
- Exploitation
- Listed in CISA’s Known Exploited Vulnerabilities catalogue since 10 Oct 2023; federal remediation due 31 Oct 2023. CISA entry
- Exploit probability
- EPSS 100.0%, 100th percentile — FIRST, scored 23 Oct 2026. FIRST EPSS
- Vendor
- IETF · HTTP/2 (CISA)
References on the NVD record
- access.redhat.com/security/cve/cve-2023-44487Vendor Advisory
- blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/Technical DescriptionVendor Advisory
- blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/Third Party AdvisoryVendor Advisory
- blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/Vendor Advisory
- blog.vespa.ai/cve-2023-44487/Vendor Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2242803Issue TrackingVendor Advisory
- bugzilla.suse.com/show_bug.cgi?id=1216123Issue TrackingVendor Advisory
- cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9Mailing ListPatchVendor Advisory
- cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/Technical DescriptionVendor Advisory
- cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attackTechnical DescriptionVendor Advisory
- community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125Vendor Advisory
- forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764Vendor Advisory
- github.com/advisories/GHSA-qppj-fm5r-hxr3Vendor Advisory
- github.com/advisories/GHSA-vx74-f528-fxqgMitigationPatchVendor Advisory
- github.com/advisories/GHSA-xpw8-rcwv-8f8pPatchVendor Advisory
- github.com/arkrwn/PoC/tree/main/CVE-2023-44487Vendor Advisory
- github.com/caddyserver/caddy/issues/5877Issue TrackingVendor Advisory
- github.com/dotnet/announcements/issues/277Issue TrackingMitigationVendor Advisory
- github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqfVendor Advisory
- groups.google.com/g/golang-announce/c/iNNxDTCjZvoMailing ListRelease NotesVendor Advisory
Sources
The verdict above is computed from the products and versions you entered and the affected ranges the vendor published to NVD. It does not inspect your environment, and this site never reports a product as unaffected: why.