# CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability

> CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability. CVSS 7.5 (CVSS 3.1), in CISA KEV.

Canonical: https://rewindex.com/cve/CVE-2023-44487
Last updated: 2026-10-14T23:51:51Z

- Published: 2023-10-10 00:00 UTC · Updated: 2026-10-14 23:51 UTC · Assigner: mitre
- CVSS: 7.5 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS: 100.0%, 100th percentile (scored 2026-10-25)
- CISA KEV: yes, added 2023-10-10, federal due date 2023-10-31, ransomware use: Unknown

## Description

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

## CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

## Affected vendors and products

- ietf: http
- Siemens: RUGGEDCOM APE1808
- Siemens: SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- Siemens: SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
- Siemens: SINEC NMS
- Siemens: SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

## Tracked companies

- [Confluence](https://rewindex.com/company/confluence.md)
- [GitLab](https://rewindex.com/company/gitlab.md)
- [Jira](https://rewindex.com/company/jira.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2023-44487)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2023-44487)
- [https://aws.amazon.com/security/security-bulletins/AWS-2023-011/](https://aws.amazon.com/security/security-bulletins/AWS-2023-011/)
- [https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/](https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/)
- [https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/](https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/)
- [https://bugzilla.proxmox.com/show\_bug.cgi?id=4988](https://bugzilla.proxmox.com/show_bug.cgi?id=4988)
- [https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9](https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9)
- [https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/](https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/)
- [https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack](https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack)
- [https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve](https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve)
- [https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764](https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764)
- [https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088](https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088)
- [https://github.com/alibaba/tengine/issues/1872](https://github.com/alibaba/tengine/issues/1872)
- [https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2](https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2)
- [https://github.com/bcdannyboy/CVE-2023-44487](https://github.com/bcdannyboy/CVE-2023-44487)
- [https://github.com/caddyserver/caddy/issues/5877](https://github.com/caddyserver/caddy/issues/5877)
- [https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1\#L73](https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73)
- [https://github.com/eclipse/jetty.project/issues/10679](https://github.com/eclipse/jetty.project/issues/10679)
- [https://github.com/envoyproxy/envoy/pull/30055](https://github.com/envoyproxy/envoy/pull/30055)
- [https://github.com/facebook/proxygen/pull/466](https://github.com/facebook/proxygen/pull/466)
- [https://github.com/grpc/grpc-go/pull/6703](https://github.com/grpc/grpc-go/pull/6703)
- [https://github.com/haproxy/haproxy/issues/2312](https://github.com/haproxy/haproxy/issues/2312)
- [https://github.com/icing/mod\_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod\_http2/README.md?plain=1\#L239-L244](https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244)
- [https://github.com/micrictor/http2-rst-stream](https://github.com/micrictor/http2-rst-stream)
- [https://github.com/microsoft/CBL-Mariner/pull/6381](https://github.com/microsoft/CBL-Mariner/pull/6381)
- [https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61](https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61)
- [https://github.com/nghttp2/nghttp2/pull/1961](https://github.com/nghttp2/nghttp2/pull/1961)
- [https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0](https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0)
- [https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo)
- [https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html](https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html)
- [https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/](https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/)
- [https://my.f5.com/manage/s/article/K000137106](https://my.f5.com/manage/s/article/K000137106)
- [https://news.ycombinator.com/item?id=37830987](https://news.ycombinator.com/item?id=37830987)
- [https://news.ycombinator.com/item?id=37830998](https://news.ycombinator.com/item?id=37830998)
- [https://news.ycombinator.com/item?id=37831062](https://news.ycombinator.com/item?id=37831062)
- [https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/](https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/)
- [https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected](https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected)
- [https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/](https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/)
- [https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/](https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/)
- [https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack](https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack)
- [http://www.openwall.com/lists/oss-security/2023/10/10/6](http://www.openwall.com/lists/oss-security/2023/10/10/6)
- [http://www.openwall.com/lists/oss-security/2023/10/10/7](http://www.openwall.com/lists/oss-security/2023/10/10/7)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2023-44487 · Markdown: https://rewindex.com/cve/CVE-2023-44487.md · JSON: https://rewindex.com/api/v1/cves/CVE-2023-44487 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:09:54.607Z