CVE-2023-44487

HIGH(7.5)KEVLikely Exploited

HTTP/2 Rapid Reset Attack Vulnerability

Description

CVE-2023-44487 is a denial of service vulnerability in the HTTP/2 protocol, widely known as the "HTTP/2 Rapid Reset" attack. This flaw allows a remote attacker to consume excessive server resources by rapidly opening and canceling HTTP/2 streams using RST_STREAM frames, overwhelming the target server without requiring authentication or user interaction. The vulnerability affects virtually every web server, proxy, and load balancer that implements HTTP/2, including products from IETF, nghttp2, Netty, Envoy, Caddy, Golang, F5, and many others. CVE-2023-44487 was actively exploited in the wild from August through October 2023 to launch record-breaking distributed denial of service (DDoS) attacks, and CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 31, 2023. With an EPSS score of 94.4%, indicating near-certain exploitation, this HTTP/2 vulnerability demands immediate attention from any organization exposing HTTP/2 endpoints.

KEV Information

Vendor
IETF
Product
HTTP/2
Date Added
October 10, 2023
Due Date
October 31, 2023
Required Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
3.6

CWEs

CWE-400Resource Consumption

Uncontrolled Resource Consumption

Affected Products

VendorProductVersion
siemenssimatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware>= 3.1.5
siemenssinec ins< 1.0; 1.0
siemenssinec nms< 3.0
siemensst7 scadaconnect< 1.1
siemensruggedcom ape1808 firmware-
siemenssimatic s7-1500 cpu 1518-4 pn\/dp mfp firmware>= 3.1.5
siemenssiplus s7-1500 cpu 1518-4 pn\/dp mfp firmware>= 3.1.5
ietfhttp2.0
nghttp2nghttp2< 1.57.0
nettynetty< 4.1.100
envoyproxyenvoy1.24.10; 1.25.9; 1.26.4; 1.27.0
eclipsejetty< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2
caddyservercaddy< 2.7.5
golanggo< 1.20.10; >= 1.21.0, < 1.21.3
golanghttp2< 0.17.0
golangnetworking< 0.17.0
f5big-ip access policy manager>= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; 17.1.0
f5big-ip advanced firewall manager>= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; 17.1.0
f5big-ip advanced web application firewall>= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; 17.1.0
f5big-ip analytics>= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; 17.1.0

Multiple CVSS Assessments

Source: [email protected](Primary)
7.5
HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0(Secondary)
7.5
HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Weakness Type

CWE-400: Uncontrolled Resource Consumption

CWE-400 describes a weakness where the software does not properly control the allocation and maintenance of a limited resource, allowing an attacker to influence the amount of resources consumed and ultimately cause a denial of service. In the case of CVE-2023-44487, the HTTP/2 protocol implementation fails to limit how quickly a client can open and reset streams, enabling an attacker to exhaust server-side resources such as memory and CPU by sending a flood of rapid stream reset requests.

Learn more: CWE-400 — Uncontrolled Resource Consumption

Impact Analysis

CVE-2023-44487 carries a CVSS v3.1 score of 7.5 (High severity) and is remotely exploitable without physical access, making any internet-facing HTTP/2 service a potential target. Attack Complexity (Low): The vulnerability requires no special conditions or preparation to exploit. Privileges Required (None): No authentication is needed, meaning any remote attacker can launch the attack. User Interaction (None): No action from a legitimate user is required to trigger the exploit. Availability Impact (High): A successful attack can render the targeted service completely unavailable, disrupting business operations, customer access, and dependent services. While confidentiality and integrity are not directly affected, the denial of service impact is severe — the attack was used to generate DDoS traffic volumes exceeding 398 million requests per second. The EPSS score of 94.4% confirms that active exploitation is near-certain, and organizations running HTTP/2 services face a high likelihood of being targeted.

Exploit Maturity

Public exploit code is available for CVE-2023-44487 via micrictor’s HTTP/2 RST stream tool on GitHub, which provides a proof-of-concept for the rapid reset attack technique. CISA has confirmed active exploitation in the wild, having added CVE-2023-44487 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 31, 2023. The EPSS score of 94.4% (99.97th percentile) indicates near-certain exploitation activity, reflecting the widespread and ongoing abuse of this vulnerability in massive DDoS campaigns. Major cloud providers including Google Cloud, Cloudflare, and AWS reported mitigating attacks exploiting this flaw at unprecedented scale during August through October 2023.

Remediation

  1. Apply vendor-specific patches and updates immediately. As the KEV required action states: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Update nghttp2 to version 1.57.0 or later, Netty to 4.1.100.Final or later, Caddy to 2.7.5 or later, and apply relevant patches for Golang, Envoy, Jetty, Apache Tomcat, Nginx, HAProxy, F5 BIG-IP, and all other affected HTTP/2 implementations in your environment.
  2. Configure HTTP/2 stream limits and rate controls. Implement server-side limits on the number of concurrent streams and the rate of RST_STREAM frames accepted per connection. Many web servers and reverse proxies have introduced configuration options specifically to mitigate rapid reset attacks.
  3. Deploy DDoS mitigation at the network edge. Use a web application firewall (WAF) or DDoS protection service (such as Cloudflare, AWS Shield, or similar) to detect and filter HTTP/2 rapid reset patterns before they reach origin servers.
  4. Monitor server resource consumption and connection behavior. Review HTTP/2 connection logs for anomalous patterns such as high volumes of stream creation followed by immediate RST_STREAM frames. Set up alerts for unusual spikes in CPU, memory, or connection counts.
  5. Implement resource consumption controls as a long-term hardening measure. Enforce per-connection and per-client resource limits, implement connection-level rate limiting, and consider disabling HTTP/2 on endpoints where it is not needed to reduce the attack surface.

Technical Details

CVE-2023-44487 exploits a fundamental aspect of the HTTP/2 protocol’s stream multiplexing mechanism. In HTTP/2, a client can open multiple streams on a single TCP connection and cancel any of them by sending a RST_STREAM frame. The rapid reset attack works by sending a request to open a stream and immediately following it with a RST_STREAM to cancel that request, then repeating this pattern at high speed. Attack Vector (Network): The attack is conducted entirely over the network, requiring only a TCP connection to the target’s HTTP/2 endpoint. Attack Complexity (Low): No special conditions are needed — the attacker simply sends well-formed HTTP/2 frames in rapid succession. The server processes each stream open request, allocating resources, but the immediate cancellation prevents the server from efficiently cleaning up those resources. Because the client cancels each request, the server’s response data is never sent back, reducing bandwidth costs for the attacker while maximizing server-side resource consumption. This asymmetry between client cost and server cost is what makes the attack so effective, enabling single machines to generate hundreds of millions of requests per second against vulnerable endpoints.

Frequently Asked Questions

Is CVE-2023-44487 being actively exploited?

Yes, CVE-2023-44487 has been actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 31, 2023. The vulnerability was used in record-breaking DDoS attacks from August through October 2023, with Google Cloud reporting mitigation of an attack peaking above 398 million requests per second.

What products are affected by CVE-2023-44487?

CVE-2023-44487 affects virtually every product that implements the HTTP/2 protocol. This includes web servers (Nginx, Apache, Caddy, LiteSpeed), proxies and load balancers (Envoy, HAProxy, Traefik), programming language libraries (Golang net/http2, nghttp2, Netty, Jetty), application platforms (Apache Tomcat, Node.js, .NET), and network appliances such as F5 BIG-IP product lines. Cloud-hosted services may also be affected depending on their HTTP/2 implementation.

How do I fix CVE-2023-44487?

Apply the latest security patches from your HTTP/2 implementation vendor. Key updates include nghttp2 1.57.0+, Netty 4.1.100.Final+, and Caddy 2.7.5+. Additionally, configure HTTP/2 stream concurrency limits and RST_STREAM rate controls on your servers, and deploy DDoS mitigation at the network edge. See the Remediation section above for detailed steps.

How severe is CVE-2023-44487?

CVE-2023-44487 is rated High severity with a CVSS v3.1 score of 7.5. While it only affects availability (not confidentiality or integrity), the real-world impact has been extreme — it enabled the largest DDoS attacks ever recorded. The EPSS score of 94.4% (99.97th percentile) indicates near-certain exploitation, making immediate patching essential for any organization with HTTP/2 endpoints.

CVSS Score

7.5
HIGH(7.5)

EPSS Score

EPSS Score100.00%
EPSS Percentile100.0%

Dates

PublishedOctober 10, 2023
Last ModifiedAugust 11, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch