CVE-2023-44487

Published Oct 10, 2023

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2023-44487, also known as Rapid Reset, is a denial-of-service (DoS) vulnerability that exploits a weakness in the HTTP/2 protocol. The attack leverages the stream multiplexing feature of HTTP/2, where numerous requests and immediate cancellations cause substantial server-side workload, while requiring minimal resources from the attacker. By rapidly sending and canceling requests, attackers can overwhelm target websites or applications, causing them to become unavailable. The vulnerability allows malicious actors to bypass server limits on data streams by issuing reset stream packets immediately after requesting a new stream. Servers may fail to clean up closed streams promptly, placing stress on the servers. This issue affects HTTP/2 server systems.

Description
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Source
cve@mitre.org
NVD status
Analyzed

Risk scores

CVSS 3.1

Type
Primary
Base score
7.5
Impact score
3.6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity
HIGH

Known exploits

Data from CISA

Vulnerability name
HTTP/2 Rapid Reset Attack Vulnerability
Exploit added on
Oct 10, 2023
Exploit action due
Oct 31, 2023
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov
NVD-CWE-noinfo
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-400

Social media

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score

1

  1. #threatreport #LowCompleteness A Coordinated Response to MadeYouReset HTTP/2 Protocol Attacks | 14-08-2025 Source: https://t.co/85tgSdRnOI Key details below ↓ 💀Threats: Madeyoureset_technique, 🎯Victims: Internet infrastructure, Server operators 🔓CVEs: CVE-2023-44487

    @rst_cloud

    15 Aug 2025

    47 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. HTTP/2に新たなDoS攻撃手法「MadeYouReset」が報告された。 従来のRapid Reset(CVE-2023-44487)対策では1TCP接続あたり最大100同時リクエストに制限していたが、本手法はサーバ側が発行するRST_STREAMを悪用し、この制限を

    @yousukezan

    14 Aug 2025

    8137 Impressions

    21 Retweets

    92 Likes

    41 Bookmarks

    0 Replies

    0 Quotes

  3. HTTP2における大規模DDoS攻撃が可能となる脆弱性"MadeYouReset"について。CERT/CCアドバイザリ。CVE-2025-8671。TomcatのCVE-2025-48989等、ベンダ毎に個別のCVEが採番されている場合あり。Rapid Reset (CVE-2023-44487)類似。 https://t.c

    @__kokumoto

    14 Aug 2025

    1527 Impressions

    8 Retweets

    14 Likes

    3 Bookmarks

    0 Replies

    0 Quotes

  4. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/slTk

    @Sn1perSecurity

    12 Aug 2025

    96 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/slTk

    @Sn1perSecurity

    25 Jul 2025

    89 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/slTk

    @Sn1perSecurity

    5 Jul 2025

    64 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. Malicious (99%) https://t.co/7ShGmdeM5d Product Nginx CVE-2021-23017 CVE-2021-3618 CVE-2022-3638 CVE-2023-44487 https://t.co/yJfVvQJJqQ https://t.co/hT3w7fzIsY

    @KulinskiArkadi

    4 Jul 2025

    63 Impressions

    1 Retweet

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/slTk

    @Sn1perSecurity

    28 Jun 2025

    81 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/slTk

    @Sn1perSecurity

    28 Jun 2025

    108 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  10. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/slTk

    @Sn1perSecurity

    17 Jun 2025

    15 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  11. Este script detecta automáticamente la versión de #Nginx y evalúa si es vulnerable CVE-2023-44487 – HTTP/2 Rapid Reset Attack CVE-2022-41741 – Corrupción de memoria en ngx_http_mp4_module CVE-2022-41742 – Revelación de memoria en ngx_http_mp4_module https://t.co/IIXA

    @hack4lifemx

    20 May 2025

    130 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  12. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/slTk

    @Sn1perSecurity

    3 May 2025

    54 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  13. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/FFRP

    @xer0dayz

    2 May 2025

    95 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  14. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/FFRP

    @xer0dayz

    28 Apr 2025

    121 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  15. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/FFRPGsHxyT

    @xer0dayz

    12 Apr 2025

    175 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  16. CVE-2023-44487 CVE-2021-23017 CVE-2021-3618 141.95.17.178 port 22 | 80 | 9100 #Anonymous

    @saw11b

    12 Apr 2025

    43 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  17. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/slTk10eGH8

    @Sn1perSecurity

    12 Apr 2025

    86 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  18. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/slTk10eGH8

    @Sn1perSecurity

    4 Apr 2025

    22 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  19. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/slTk10eGH8

    @Sn1perSecurity

    13 Mar 2025

    74 Impressions

    1 Retweet

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  20. {"cpes":openbsd:openssh:8.4p1","cpe:/o:debian:debian_linux","cpe:/a:f5:nginx:1.18.0"],"hostnames":["https://t.co/KQeBMZwqHr",],"ip":"23.95.39.61","ports":[21,22,80,443,5222,5269],"tags":["eol-product"],"vulns":["CVE-2023-44487","CVE-2021-23017","CVE-2021-3618"]}

    @portknock

    10 Mar 2025

    6 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  21. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/FFRPGsHxyT

    @xer0dayz

    8 Mar 2025

    185 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  22. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/FFRPGsHxyT

    @xer0dayz

    22 Feb 2025

    138 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  23. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/FFRPGsHxyT

    @xer0dayz

    5 Feb 2025

    193 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  24. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/FFRPGsHxyT

    @xer0dayz

    4 Feb 2025

    182 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  25. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/FFRPGsHxyT

    @xer0dayz

    24 Jan 2025

    155 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  26. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/slTk10eGH8

    @Sn1perSecurity

    15 Jan 2025

    54 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  27. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/slTk10eGH8

    @Sn1perSecurity

    31 Dec 2024

    56 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  28. CVE-2024-12698 An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only unauthenticated streams were … https://t.co/VcOGtro9yB

    @CVEnew

    18 Dec 2024

    407 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  29. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/slTk10eGH8

    @Sn1perSecurity

    12 Dec 2024

    45 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  30. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/FFRPGsHxyT

    @xer0dayz

    2 Dec 2024

    13 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  31. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/slTk10eGH8

    @Sn1perSecurity

    26 Nov 2024

    11 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  32. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/slTk10eGH8

    @Sn1perSecurity

    22 Nov 2024

    38 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  33. {"hostnames":["https://t.co/lsjL6hNT8q","https://t.co/Lurbv4tXGG"],"ip":"104.131.14.208","ports":[22,25,80,443,3000,3001],"tags":["cloud","self-signed","starttls","eol-product"],"vulns":["CVE-2021-23017","CVE-2021-3618","CVE-2023-44487"]}

    @ClumsyLulzReal

    17 Nov 2024

    4 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  34. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/slTk10eGH8

    @Sn1perSecurity

    1 Nov 2024

    54 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  35. 🔒 Our latest Fuzzer module update enhances web security testing with dynamic search for URL file lists, Nuclei's custom scan options, basic authentication brute force, CVE-2023-44487 HTTP2 DDoS testing, and HTTP Smuggler for single and multi-targets. 💻🔐 https://t.co/slTk10eGH8

    @Sn1perSecurity

    30 Oct 2024

    59 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations

References

Sources include official advisories and independent security research.