CVE-2023-44487

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-44487
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://aws.amazon.com/security/security-bulletins/AWS-2023-011/ Vendor Advisory
https://news.ycombinator.com/item?id=37831062 Issue Tracking Third Party Advisory
https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack Press/Media Coverage
https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/ Vendor Advisory
https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack Technical Description Vendor Advisory
https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/ Technical Description Vendor Advisory
https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ Mitigation Vendor Advisory
https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ Technical Description Vendor Advisory
https://github.com/bcdannyboy/CVE-2023-44487 Third Party Advisory
https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/ Third Party Advisory
https://github.com/eclipse/jetty.project/issues/10679 Issue Tracking Vendor Advisory
https://github.com/alibaba/tengine/issues/1872 Issue Tracking Vendor Advisory
https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764 Vendor Advisory
https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61 Patch Vendor Advisory
https://github.com/nghttp2/nghttp2/pull/1961 Patch Vendor Advisory
https://news.ycombinator.com/item?id=37830987 Issue Tracking Third Party Advisory
https://news.ycombinator.com/item?id=37830998 Issue Tracking Press/Media Coverage
https://github.com/envoyproxy/envoy/pull/30055 Patch Vendor Advisory
https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2 Product Third Party Advisory
https://github.com/caddyserver/caddy/issues/5877 Issue Tracking Vendor Advisory
https://github.com/haproxy/haproxy/issues/2312 Issue Tracking Vendor Advisory
https://github.com/grpc/grpc-go/pull/6703 Patch Vendor Advisory
https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244 Product Vendor Advisory
https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0 Release Notes Third Party Advisory
https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html Mailing List Patch Third Party Advisory
https://my.f5.com/manage/s/article/K000137106 Vendor Advisory
https://bugzilla.proxmox.com/show_bug.cgi?id=4988 Issue Tracking Third Party Advisory
https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/ Patch Vendor Advisory
https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 Mailing List Patch Vendor Advisory
https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088 Third Party Advisory
https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve Technical Description Third Party Advisory
https://github.com/micrictor/http2-rst-stream Exploit Third Party Advisory
https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf Vendor Advisory
https://github.com/dotnet/announcements/issues/277 Mitigation Vendor Advisory
https://github.com/apache/trafficserver/pull/10564 Patch Vendor Advisory
https://github.com/facebook/proxygen/pull/466 Patch Vendor Advisory
https://github.com/microsoft/CBL-Mariner/pull/6381 Patch Vendor Advisory
https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo Mailing List Vendor Advisory
https://github.com/nodejs/node/pull/50121 Vendor Advisory
https://github.com/h2o/h2o/pull/3291 Patch Third Party Advisory
https://github.com/advisories/GHSA-vx74-f528-fxqg Mitigation Patch Vendor Advisory
https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/ Third Party Advisory
https://github.com/golang/go/issues/63417 Issue Tracking Vendor Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487 Mitigation Patch Vendor Advisory
https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q Mailing List Vendor Advisory
https://www.openwall.com/lists/oss-security/2023/10/10/6 Mailing List Third Party Advisory
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14 Release Notes Vendor Advisory
https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected Third Party Advisory
https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73 Product Release Notes Vendor Advisory
https://github.com/kubernetes/kubernetes/pull/121120 Patch Vendor Advisory
https://github.com/oqtane/oqtane.framework/discussions/3367 Issue Tracking Vendor Advisory
https://github.com/opensearch-project/data-prepper/issues/3474 Issue Tracking Patch Vendor Advisory
https://github.com/advisories/GHSA-xpw8-rcwv-8f8p Patch Vendor Advisory
https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 Vendor Advisory
https://netty.io/news/2023/10/10/4-1-100-Final.html Release Notes Vendor Advisory
https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack Press/Media Coverage Third Party Advisory
https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/ Press/Media Coverage Third Party Advisory
https://news.ycombinator.com/item?id=37837043 Issue Tracking
https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487 Third Party Advisory US Government Resource
https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113 Product Third Party Advisory
https://github.com/kazu-yamamoto/http2/issues/93 Issue Tracking Third Party Advisory
https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html Third Party Advisory
https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1 Patch Third Party Advisory
https://www.debian.org/security/2023/dsa-5522 Vendor Advisory
https://www.debian.org/security/2023/dsa-5521 Vendor Advisory
https://blog.vespa.ai/cve-2023-44487/ Vendor Advisory
https://github.com/tempesta-tech/tempesta/issues/1986 Issue Tracking Vendor Advisory
https://ubuntu.com/security/CVE-2023-44487 Vendor Advisory
https://access.redhat.com/security/cve/cve-2023-44487 Vendor Advisory
https://github.com/junkurihara/rust-rpxy/issues/97 Issue Tracking Vendor Advisory
https://istio.io/latest/news/security/istio-security-2023-004/ Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2242803 Issue Tracking Vendor Advisory
https://github.com/etcd-io/etcd/issues/16740 Issue Tracking Patch Vendor Advisory
https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125 Vendor Advisory
https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event Press/Media Coverage Third Party Advisory
https://github.com/advisories/GHSA-qppj-fm5r-hxr3 Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1216123 Issue Tracking Vendor Advisory
https://github.com/ninenines/cowboy/issues/1615 Issue Tracking Vendor Advisory
https://github.com/varnishcache/varnish-cache/issues/3996 Issue Tracking Vendor Advisory
https://github.com/apache/httpd-site/pull/10 Issue Tracking Vendor Advisory
https://github.com/line/armeria/pull/5232 Issue Tracking Patch Vendor Advisory
https://github.com/projectcontour/contour/pull/5826 Issue Tracking Patch Vendor Advisory
https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632 Vendor Advisory
https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/ Vendor Advisory
https://github.com/akka/akka-http/issues/4323 Issue Tracking Vendor Advisory
https://github.com/apache/apisix/issues/10320 Issue Tracking Vendor Advisory
https://github.com/openresty/openresty/issues/930 Issue Tracking Vendor Advisory
https://github.com/Azure/AKS/issues/3947 Issue Tracking Vendor Advisory
https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487 Vendor Advisory
https://security.paloaltonetworks.com/CVE-2023-44487 Vendor Advisory
https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/ Vendor Advisory
https://github.com/Kong/kong/discussions/11741 Issue Tracking Vendor Advisory
https://github.com/caddyserver/caddy/releases/tag/v2.7.5 Release Notes Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/13/4 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/13/9 Mailing List Third Party Advisory
https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html Mailing List Third Party Advisory
https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/ Press/Media Coverage Third Party Advisory
https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/ Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20231016-0001/ Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/18/4 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/18/8 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/19/6 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/20/8 Mailing List
https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html Third Party Advisory
https://www.debian.org/security/2023/dsa-5540 Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html Third Party Advisory
https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715 Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html Mailing List Third Party Advisory
https://www.debian.org/security/2023/dsa-5549 Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/ Mailing List Third Party Advisory
https://www.debian.org/security/2023/dsa-5558 Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202311-09 Third Party Advisory
https://www.debian.org/security/2023/dsa-5570 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ietf:http:2.0:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:envoyproxy:envoy:1.27.0:*:*:*:*:*:*:*
cpe:2.3:a:envoyproxy:envoy:1.26.4:*:*:*:*:*:*:*
cpe:2.3:a:envoyproxy:envoy:1.25.9:*:*:*:*:*:*:*
cpe:2.3:a:envoyproxy:envoy:1.24.10:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*

Configuration 6 (hide)

cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*

Configuration 7 (hide)

OR cpe:2.3:a:golang:http2:*:*:*:*:*:go:*:*
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
cpe:2.3:a:golang:networking:*:*:*:*:*:go:*:*

Configuration 8 (hide)

OR cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_access_policy_manager:17.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:17.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_analytics:17.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:17.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_security_manager:17.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:17.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_carrier-grade_nat:17.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:17.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_domain_name_system:17.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_fraud_protection_service:17.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_global_traffic_manager:17.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_link_controller:17.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:17.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:17.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:17.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_websafe:17.1.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:nginx_plus:r30:-:*:*:*:*:*:*
cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:nginx_plus:r29:-:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_next:20.0.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_next_service_proxy_for_kubernetes:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*

Configuration 9 (hide)

OR cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Configuration 10 (hide)

cpe:2.3:a:apple:swiftnio_http\/2:*:*:*:*:*:swift:*:*

Configuration 11 (hide)

OR cpe:2.3:a:grpc:grpc:1.57.0:-:*:*:*:go:*:*
cpe:2.3:a:grpc:grpc:*:*:*:*:*:go:*:*
cpe:2.3:a:grpc:grpc:*:*:*:*:*:go:*:*
cpe:2.3:a:grpc:grpc:*:*:*:*:*:-:*:*

Configuration 12 (hide)

OR cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:azure_kubernetes_service:*:*:*:*:*:*:*:*

Configuration 13 (hide)

OR cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*

Configuration 14 (hide)

cpe:2.3:a:microsoft:cbl-mariner:*:*:*:*:*:*:*:*

Configuration 15 (hide)

cpe:2.3:a:dena:h2o:*:*:*:*:*:*:*:*

Configuration 16 (hide)

cpe:2.3:a:facebook:proxygen:*:*:*:*:*:*:*:*

Configuration 17 (hide)

OR cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*

Configuration 18 (hide)

cpe:2.3:a:amazon:opensearch_data_prepper:*:*:*:*:*:*:*:*

Configuration 19 (hide)

OR cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*

Configuration 20 (hide)

cpe:2.3:a:kazu-yamamoto:http2:*:*:*:*:*:*:*:*

Configuration 21 (hide)

OR cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*
cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*
cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*

Configuration 22 (hide)

cpe:2.3:a:varnish_cache_project:varnish_cache:*:*:*:*:*:*:*:*

Configuration 23 (hide)

OR cpe:2.3:a:traefik:traefik:3.0.0:beta3:*:*:*:*:*:*
cpe:2.3:a:traefik:traefik:3.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:traefik:traefik:3.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*

Configuration 24 (hide)

cpe:2.3:a:projectcontour:contour:*:*:*:*:*:kubernetes:*:*

Configuration 25 (hide)

OR cpe:2.3:a:linkerd:linkerd:2.13.0:*:*:*:stable:kubernetes:*:*
cpe:2.3:a:linkerd:linkerd:2.13.1:*:*:*:stable:kubernetes:*:*
cpe:2.3:a:linkerd:linkerd:2.14.0:*:*:*:stable:kubernetes:*:*
cpe:2.3:a:linkerd:linkerd:2.14.1:*:*:*:stable:kubernetes:*:*
cpe:2.3:a:linkerd:linkerd:*:*:*:*:stable:kubernetes:*:*

Configuration 26 (hide)

cpe:2.3:a:linecorp:armeria:*:*:*:*:*:*:*:*

Configuration 27 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_service_mesh:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_a-mq:7:*:*:*:*:*:*:*
cpe:2.3:a:redhat:3scale_api_management_platform:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage:5.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:integration_camel_for_spring_boot:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:migration_toolkit_for_applications:6.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_developer_tools_and_services:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_api_for_data_protection:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_serverless:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:build_of_optaplanner:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_data_science:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:advanced_cluster_security:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:advanced_cluster_security:3.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cert-manager_operator_for_red_hat_openshift:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_dev_spaces:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cost_management:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:migration_toolkit_for_virtualization:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_a-mq_streams:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cryostat:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:network_observability_operator:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:node_healthcheck_operator:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_gitops:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_virtualization:4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:logging_subsystem_for_red_hat_openshift:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_pipelines:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_sandboxed_containers:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_secondary_scheduler_operator:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_assisted_installer:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:certification_for_red_hat_enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:certification_for_red_hat_enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:migration_toolkit_for_containers:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack_platform:17.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift:-:*:*:*:*:aws:*:*
cpe:2.3:a:redhat:run_once_duration_override_operator:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:service_interconnect:1.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_distributed_tracing:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:support_for_spring_boot:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:web_terminal:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:node_maintenance_operator:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:machine_deletion_remediation_operator:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:fence_agents_remediation_operator:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:self_node_remediation_operator:-:*:*:*:*:*:*:*

Configuration 28 (hide)

AND
cpe:2.3:a:redhat:service_telemetry_framework:1.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Configuration 29 (hide)

OR cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

Configuration 30 (hide)

cpe:2.3:a:netapp:astra_control_center:-:*:*:*:*:*:*:*

Configuration 31 (hide)

cpe:2.3:a:akka:http_server:*:*:*:*:*:*:*:*

Configuration 32 (hide)

cpe:2.3:a:konghq:kong_gateway:*:*:*:*:enterprise:*:*:*

Configuration 33 (hide)

OR cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*

Configuration 34 (hide)

cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*

Configuration 35 (hide)

cpe:2.3:a:openresty:openresty:*:*:*:*:*:*:*:*
Information

Published : 2023-10-10 14:15

Updated : 2023-12-20 17:55

NVD link : CVE-2023-44487

Mitre link : CVE-2023-44487

JSON object : View

Products Affected

f5

  • nginx_plus
  • big-ip_access_policy_manager
  • big-ip_analytics
  • big-ip_advanced_web_application_firewall
  • big-ip_carrier-grade_nat
  • big-ip_global_traffic_manager
  • big-ip_websafe
  • big-ip_domain_name_system
  • big-ip_local_traffic_manager
  • big-ip_next
  • big-ip_policy_enforcement_manager
  • nginx_ingress_controller
  • big-ip_application_visibility_and_reporting
  • big-ip_application_acceleration_manager
  • big-ip_ssl_orchestrator
  • big-ip_webaccelerator
  • nginx
  • big-ip_application_security_manager
  • big-ip_advanced_firewall_manager
  • big-ip_fraud_protection_service
  • big-ip_next_service_proxy_for_kubernetes
  • big-ip_link_controller
  • big-ip_ddos_hybrid_defender

redhat

  • advanced_cluster_management_for_kubernetes
  • logging_subsystem_for_red_hat_openshift
  • process_automation
  • build_of_quarkus
  • integration_service_registry
  • self_node_remediation_operator
  • openshift_sandboxed_containers
  • jboss_a-mq_streams
  • machine_deletion_remediation_operator
  • openshift_service_mesh
  • jboss_a-mq
  • advanced_cluster_security
  • openshift_gitops
  • openshift_pipelines
  • web_terminal
  • ceph_storage
  • service_telemetry_framework
  • 3scale_api_management_platform
  • openshift_container_platform
  • enterprise_linux
  • node_healthcheck_operator
  • integration_camel_for_spring_boot
  • openshift_container_platform_assisted_installer
  • fence_agents_remediation_operator
  • cryostat
  • jboss_fuse
  • satellite
  • integration_camel_k
  • openshift_virtualization
  • openshift_developer_tools_and_services
  • jboss_data_grid
  • openstack_platform
  • run_once_duration_override_operator
  • build_of_optaplanner
  • cost_management
  • cert-manager_operator_for_red_hat_openshift
  • support_for_spring_boot
  • service_interconnect
  • openshift_data_science
  • openshift_serverless
  • openshift_distributed_tracing
  • openshift_api_for_data_protection
  • openshift_secondary_scheduler_operator
  • network_observability_operator
  • quay
  • openshift_dev_spaces
  • jboss_core_services
  • single_sign-on
  • jboss_enterprise_application_platform
  • openshift
  • certification_for_red_hat_enterprise_linux
  • ansible_automation_platform
  • node_maintenance_operator
  • migration_toolkit_for_containers
  • decision_manager
  • migration_toolkit_for_virtualization
  • migration_toolkit_for_applications

golang

  • http2
  • networking
  • go

eclipse

  • jetty

nghttp2

  • nghttp2

ietf

  • http

dena

  • h2o

projectcontour

  • contour

caddyserver

  • caddy

microsoft

  • windows_11_22h2
  • cbl-mariner
  • windows_10_22h2
  • azure_kubernetes_service
  • windows_10_21h2
  • asp.net_core
  • windows_server_2016
  • windows_server_2019
  • windows_10_1809
  • windows_10_1607
  • .net
  • windows_server_2022
  • visual_studio_2022
  • windows_11_21h2

varnish_cache_project

  • varnish_cache

facebook

  • proxygen

apache

  • tomcat
  • traffic_server
  • apisix
  • solr

traefik

  • traefik

istio

  • istio

netty

  • netty

grpc

  • grpc

amazon

  • opensearch_data_prepper

nodejs

  • node.js

linkerd

  • linkerd

kazu-yamamoto

  • http2

openresty

  • openresty

envoyproxy

  • envoy

apple

  • swiftnio_http\/2

debian

  • debian_linux

fedoraproject

  • fedora

netapp

  • astra_control_center

konghq

  • kong_gateway

linecorp

  • armeria

akka

  • http_server

jenkins

  • jenkins
CWE
CWE-400

Uncontrolled Resource Consumption