High · published October 10, 2023
CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.
🚨 A crafty request cancellation can lead to a server resource drain faster than you can say "HTTP/2!" ⚡️ Think of it like a chaotic restaurant where customers keep canceling their orders at the last minute — the kitchen gets swamped trying to process new requests while still juggling the old ones, leading to a complete standstill! If an attacker exploits this vulnerability, they could quickly overwhelm your server, causing significant downtime and service interruptions. This could lead to all sorts of chaos, from frustrated users to potential revenue loss as your site becomes inaccessible. It's a situation you definitely want to avoid!
Think of it like a chaotic restaurant where customers keep canceling their orders at the last minute — the kitchen gets swamped trying to process new requests while still juggling the old ones, leading to a complete standstill! CVE-2023-44487 in the HTTP/2 protocol allows an attacker to reset multiple streams by rapidly canceling requests, leading to excessive resource consumption and potential denial of service.
If an attacker exploits this vulnerability, they could quickly overwhelm your server, causing significant downtime and service interruptions. This could lead to all sorts of chaos, from frustrated users to potential revenue loss as your site becomes inaccessible. It's a situation you definitely want to avoid! To protect your servers, ensure you're running the latest version of your web server software that addresses this vulnerability. Additionally, consider implementing rate limiting on requests to help mitigate rapid-fire cancellation attacks. Regularly monitor your server performance to catch any abnormal spikes early! You've got this! Tackle the issue head-on and keep your server running smoothly! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| siemens/simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware | ≥ 3.1.5 | — |
| siemens/sinec_ins | < 1.0 | 1.0 |
| siemens/sinec_ins | all versions | — |
| siemens/sinec_ins | all versions | — |
| siemens/sinec_ins | all versions | — |
| siemens/sinec_ins | all versions | — |
| siemens/sinec_ins | all versions | — |
| siemens/sinec_nms | < 3.0 | 3.0 |
| siemens/st7_scadaconnect | < 1.1 | 1.1 |
| siemens/ruggedcom_ape1808_firmware | all versions | — |
| siemens/simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware | ≥ 3.1.5 | — |
| siemens/siplus_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware | ≥ 3.1.5 | — |
| ietf/http | all versions | — |
| nghttp2/nghttp2 | < 1.57.0 | 1.57.0 |
| netty/netty | < 4.1.100 | 4.1.100 |
| envoyproxy/envoy | all versions | — |
| envoyproxy/envoy | all versions | — |
| envoyproxy/envoy | all versions | — |
| envoyproxy/envoy | all versions | — |
| eclipse/jetty | < 9.4.53 | 9.4.53 |
| eclipse/jetty | ≥ 10.0.0, < 10.0.17 | 10.0.17 |
| eclipse/jetty | ≥ 11.0.0, < 11.0.17 | 11.0.17 |
| eclipse/jetty | ≥ 12.0.0, < 12.0.2 | 12.0.2 |
| caddyserver/caddy | < 2.7.5 | 2.7.5 |
| golang/go | < 1.20.10 | 1.20.10 |
| golang/go | ≥ 1.21.0, < 1.21.3 | 1.21.3 |
| golang/http2 | < 0.17.0 | 0.17.0 |
| golang/networking | < 0.17.0 | 0.17.0 |
| f5/big-ip_access_policy_manager | ≥ 13.1.0, ≤ 13.1.5 | — |
| f5/big-ip_access_policy_manager | ≥ 14.1.0, ≤ 14.1.5 | — |
| f5/big-ip_access_policy_manager | ≥ 15.1.0, ≤ 15.1.10 | — |
| f5/big-ip_access_policy_manager | ≥ 16.1.0, ≤ 16.1.4 | — |
| f5/big-ip_access_policy_manager | all versions | — |
| f5/big-ip_advanced_firewall_manager | ≥ 13.1.0, ≤ 13.1.5 | — |
| f5/big-ip_advanced_firewall_manager | ≥ 14.1.0, ≤ 14.1.5 | — |
| f5/big-ip_advanced_firewall_manager | ≥ 15.1.0, ≤ 15.1.10 | — |
| f5/big-ip_advanced_firewall_manager | ≥ 16.1.0, ≤ 16.1.4 | — |
| f5/big-ip_advanced_firewall_manager | all versions | — |
| f5/big-ip_advanced_web_application_firewall | ≥ 13.1.0, ≤ 13.1.5 | — |
| f5/big-ip_advanced_web_application_firewall | ≥ 14.1.0, ≤ 14.1.5 | — |
| f5/big-ip_advanced_web_application_firewall | ≥ 15.1.0, ≤ 15.1.10 | — |
| f5/big-ip_advanced_web_application_firewall | ≥ 16.1.0, ≤ 16.1.4 | — |
| f5/big-ip_advanced_web_application_firewall | all versions | — |
| f5/big-ip_analytics | ≥ 13.1.0, ≤ 13.1.5 | — |
| f5/big-ip_analytics | ≥ 14.1.0, ≤ 14.1.5 | — |
| f5/big-ip_analytics | ≥ 15.1.0, ≤ 15.1.10 | — |
| f5/big-ip_analytics | ≥ 16.1.0, ≤ 16.1.4 | — |
| f5/big-ip_analytics | all versions | — |
| f5/big-ip_application_acceleration_manager | ≥ 13.1.0, ≤ 13.1.5 | — |
| f5/big-ip_application_acceleration_manager | ≥ 14.1.0, ≤ 14.1.5 | — |
| f5/big-ip_application_acceleration_manager | ≥ 15.1.0, ≤ 15.1.10 | — |
| f5/big-ip_application_acceleration_manager | ≥ 16.1.0, ≤ 16.1.4 | — |
| f5/big-ip_application_acceleration_manager | all versions | — |
| f5/big-ip_application_security_manager | ≥ 13.1.0, ≤ 13.1.5 | — |
| f5/big-ip_application_security_manager | ≥ 14.1.0, ≤ 14.1.5 | — |
| f5/big-ip_application_security_manager | ≥ 15.1.0, ≤ 15.1.10 | — |
| f5/big-ip_application_security_manager | ≥ 16.1.0, ≤ 16.1.4 | — |
| f5/big-ip_application_security_manager | all versions | — |
| f5/big-ip_application_visibility_and_reporting | ≥ 13.1.0, ≤ 13.1.5 | — |
| f5/big-ip_application_visibility_and_reporting | ≥ 14.1.0, ≤ 14.1.5 | — |
| f5/big-ip_application_visibility_and_reporting | ≥ 15.1.0, ≤ 15.1.10 | — |
| f5/big-ip_application_visibility_and_reporting | ≥ 16.1.0, ≤ 16.1.4 | — |
| f5/big-ip_application_visibility_and_reporting | all versions | — |
| f5/big-ip_carrier-grade_nat | ≥ 13.1.0, ≤ 13.1.5 | — |
| f5/big-ip_carrier-grade_nat | ≥ 14.1.0, ≤ 14.1.5 | — |
| f5/big-ip_carrier-grade_nat | ≥ 15.1.0, ≤ 15.1.10 | — |
| f5/big-ip_carrier-grade_nat | ≥ 16.1.0, ≤ 16.1.4 | — |
| f5/big-ip_carrier-grade_nat | all versions | — |
| f5/big-ip_ddos_hybrid_defender | ≥ 13.1.0, ≤ 13.1.5 | — |
| f5/big-ip_ddos_hybrid_defender | ≥ 14.1.0, ≤ 14.1.5 | — |
| f5/big-ip_ddos_hybrid_defender | ≥ 15.1.0, ≤ 15.1.10 | — |
| f5/big-ip_ddos_hybrid_defender | ≥ 16.1.0, ≤ 16.1.4 | — |
| f5/big-ip_ddos_hybrid_defender | all versions | — |
| f5/big-ip_domain_name_system | ≥ 13.1.0, ≤ 13.1.5 | — |
| f5/big-ip_domain_name_system | ≥ 14.1.0, ≤ 14.1.5 | — |
| f5/big-ip_domain_name_system | ≥ 15.1.0, ≤ 15.1.10 | — |
| f5/big-ip_domain_name_system | ≥ 16.1.0, ≤ 16.1.4 | — |
| f5/big-ip_domain_name_system | all versions | — |
| f5/big-ip_fraud_protection_service | ≥ 13.1.0, ≤ 13.1.5 | — |
| f5/big-ip_fraud_protection_service | ≥ 14.1.0, ≤ 14.1.5 | — |
| f5/big-ip_fraud_protection_service | ≥ 15.1.0, ≤ 15.1.10 | — |
| f5/big-ip_fraud_protection_service | ≥ 16.1.0, ≤ 16.1.4 | — |
| f5/big-ip_fraud_protection_service | all versions | — |
| f5/big-ip_global_traffic_manager | ≥ 13.1.0, ≤ 13.1.5 | — |
| f5/big-ip_global_traffic_manager | ≥ 14.1.0, ≤ 14.1.5 | — |
| f5/big-ip_global_traffic_manager | ≥ 15.1.0, ≤ 15.1.10 | — |
| f5/big-ip_global_traffic_manager | ≥ 16.1.0, ≤ 16.1.4 | — |
| f5/big-ip_global_traffic_manager | all versions | — |
| f5/big-ip_link_controller | ≥ 13.1.0, ≤ 13.1.5 | — |
| f5/big-ip_link_controller | ≥ 14.1.0, ≤ 14.1.5 | — |
| f5/big-ip_link_controller | ≥ 15.1.0, ≤ 15.1.10 | — |
| f5/big-ip_link_controller | ≥ 16.1.0, ≤ 16.1.4 | — |
| f5/big-ip_link_controller | all versions | — |
| f5/big-ip_local_traffic_manager | ≥ 13.1.0, ≤ 13.1.5 | — |
| f5/big-ip_local_traffic_manager | ≥ 14.1.0, ≤ 14.1.5 | — |
| f5/big-ip_local_traffic_manager | ≥ 15.1.0, ≤ 15.1.10 | — |
| f5/big-ip_local_traffic_manager | ≥ 16.1.0, ≤ 16.1.4 | — |
| f5/big-ip_local_traffic_manager | all versions | — |
| f5/big-ip_next | all versions | — |
| f5/big-ip_next_service_proxy_for_kubernetes | ≥ 1.5.0, ≤ 1.8.2 | — |
| f5/big-ip_policy_enforcement_manager | ≥ 13.1.0, ≤ 13.1.5 | — |
| f5/big-ip_policy_enforcement_manager | ≥ 14.1.0, ≤ 14.1.5 | — |
| f5/big-ip_policy_enforcement_manager | ≥ 15.1.0, ≤ 15.1.10 | — |
| f5/big-ip_policy_enforcement_manager | ≥ 16.1.0, ≤ 16.1.4 | — |
| f5/big-ip_policy_enforcement_manager | all versions | — |
| f5/big-ip_ssl_orchestrator | ≥ 13.1.0, ≤ 13.1.5 | — |
| f5/big-ip_ssl_orchestrator | ≥ 14.1.0, ≤ 14.1.5 | — |
| f5/big-ip_ssl_orchestrator | ≥ 15.1.0, ≤ 15.1.10 | — |
| f5/big-ip_ssl_orchestrator | ≥ 16.1.0, ≤ 16.1.4 | — |
| f5/big-ip_ssl_orchestrator | all versions | — |
| f5/big-ip_webaccelerator | ≥ 13.1.0, ≤ 13.1.5 | — |
| f5/big-ip_webaccelerator | ≥ 14.1.0, ≤ 14.1.5 | — |
| f5/big-ip_webaccelerator | ≥ 15.1.0, ≤ 15.1.10 | — |
| f5/big-ip_webaccelerator | ≥ 16.1.0, ≤ 16.1.4 | — |
| f5/big-ip_webaccelerator | all versions | — |
| f5/big-ip_websafe | ≥ 13.1.0, ≤ 13.1.5 | — |
| f5/big-ip_websafe | ≥ 14.1.0, ≤ 14.1.5 | — |
| f5/big-ip_websafe | ≥ 15.1.0, ≤ 15.1.10 | — |
| f5/big-ip_websafe | ≥ 16.1.0, ≤ 16.1.4 | — |
| f5/big-ip_websafe | all versions | — |
| f5/nginx | ≥ 1.9.5, ≤ 1.25.2 | — |
| f5/nginx_ingress_controller | ≥ 2.0.0, ≤ 2.4.2 | — |
| f5/nginx_ingress_controller | ≥ 3.0.0, ≤ 3.3.0 | — |
| f5/nginx_plus | ≥ r25, < r29 | r29 |
| f5/nginx_plus | all versions | — |
| f5/nginx_plus | all versions | — |
| apache/tomcat | ≥ 8.5.0, ≤ 8.5.93 | — |
| apache/tomcat | ≥ 9.0.0, ≤ 9.0.80 | — |
| apache/tomcat | ≥ 10.1.0, ≤ 10.1.13 | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apple/swiftnio_http\/2 | < 1.28.0 | 1.28.0 |
| grpc/grpc | < 1.56.3 | 1.56.3 |
| grpc/grpc | ≤ 1.59.2 | — |
| grpc/grpc | ≥ 1.58.0, < 1.58.3 | 1.58.3 |
| grpc/grpc | all versions | — |
| microsoft/.net | ≥ 6.0.0, < 6.0.23 | 6.0.23 |
| microsoft/.net | ≥ 7.0.0, < 7.0.12 | 7.0.12 |
| microsoft/asp.net_core | ≥ 6.0.0, < 6.0.23 | 6.0.23 |
| microsoft/asp.net_core | ≥ 7.0.0, < 7.0.12 | 7.0.12 |
| microsoft/azure_kubernetes_service | < 2023-10-08 | 2023-10-08 |
| microsoft/visual_studio_2022 | ≥ 17.0, < 17.2.20 | 17.2.20 |
| microsoft/visual_studio_2022 | ≥ 17.4, < 17.4.12 | 17.4.12 |
| microsoft/visual_studio_2022 | ≥ 17.6, < 17.6.8 | 17.6.8 |
| microsoft/visual_studio_2022 | ≥ 17.7, < 17.7.5 | 17.7.5 |
| microsoft/windows_10_1607 | < 10.0.14393.6351 | 10.0.14393.6351 |
| microsoft/windows_10_1607 | < 10.0.14393.6351 | 10.0.14393.6351 |
| microsoft/windows_10_1809 | < 10.0.17763.4974 | 10.0.17763.4974 |
| microsoft/windows_10_21h2 | < 10.0.19044.3570 | 10.0.19044.3570 |
| microsoft/windows_10_22h2 | < 10.0.19045.3570 | 10.0.19045.3570 |
| microsoft/windows_11_21h2 | < 10.0.22000.2538 | 10.0.22000.2538 |
| microsoft/windows_11_22h2 | < 10.0.22621.2428 | 10.0.22621.2428 |
| microsoft/windows_server_2016 | all versions | — |
| microsoft/windows_server_2019 | all versions | — |
| microsoft/windows_server_2022 | all versions | — |
| nodejs/node.js | ≥ 18.0.0, < 18.18.2 | 18.18.2 |
| nodejs/node.js | ≥ 20.0.0, < 20.8.1 | 20.8.1 |
| microsoft/cbl-mariner | < 2023-10-11 | 2023-10-11 |
| dena/h2o | < 2023-10-10 | 2023-10-10 |
| facebook/proxygen | < 2023.10.16.00 | 2023.10.16.00 |
| apache/apisix | < 3.6.1 | 3.6.1 |
| apache/traffic_server | ≥ 8.0.0, < 8.1.9 | 8.1.9 |
| apache/traffic_server | ≥ 9.0.0, < 9.2.3 | 9.2.3 |
| amazon/opensearch_data_prepper | < 2.5.0 | 2.5.0 |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| kazu-yamamoto/http2 | < 4.2.2 | 4.2.2 |
| istio/istio | < 1.17.6 | 1.17.6 |
| istio/istio | ≥ 1.18.0, < 1.18.3 | 1.18.3 |
| istio/istio | ≥ 1.19.0, < 1.19.1 | 1.19.1 |
| varnish_cache_project/varnish_cache | < 2023-10-10 | 2023-10-10 |
| traefik/traefik | < 2.10.5 | 2.10.5 |
| traefik/traefik | all versions | — |
| traefik/traefik | all versions | — |
| traefik/traefik | all versions | — |
| projectcontour/contour | < 2023-10-11 | 2023-10-11 |
| linkerd/linkerd | ≥ 2.12.0, ≤ 2.12.5 | — |
| linkerd/linkerd | all versions | — |
| linkerd/linkerd | all versions | — |
| linkerd/linkerd | all versions | — |
| linkerd/linkerd | all versions | — |
| linecorp/armeria | < 1.26.0 | 1.26.0 |
| redhat/3scale_api_management_platform | all versions | — |
| redhat/advanced_cluster_management_for_kubernetes | all versions | — |
| redhat/advanced_cluster_security | all versions | — |
| redhat/advanced_cluster_security | all versions | — |
| redhat/ansible_automation_platform | all versions | — |
| redhat/build_of_optaplanner | all versions | — |
| redhat/build_of_quarkus | all versions | — |
| redhat/ceph_storage | all versions | — |
| redhat/cert-manager_operator_for_red_hat_openshift | all versions | — |
| redhat/certification_for_red_hat_enterprise_linux | all versions | — |
| redhat/certification_for_red_hat_enterprise_linux | all versions | — |
| redhat/cost_management | all versions | — |
| redhat/cryostat | all versions | — |
| redhat/decision_manager | all versions | — |
| redhat/fence_agents_remediation_operator | all versions | — |
| redhat/integration_camel_for_spring_boot | all versions | — |
| redhat/integration_camel_k | all versions | — |
| redhat/integration_service_registry | all versions | — |
| redhat/jboss_a-mq | all versions | — |
| redhat/jboss_a-mq_streams | all versions | — |
| redhat/jboss_core_services | all versions | — |
| redhat/jboss_data_grid | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| redhat/jboss_fuse | all versions | — |
| redhat/jboss_fuse | all versions | — |
| redhat/logging_subsystem_for_red_hat_openshift | all versions | — |
| redhat/machine_deletion_remediation_operator | all versions | — |
| redhat/migration_toolkit_for_applications | all versions | — |
| redhat/migration_toolkit_for_containers | all versions | — |
| redhat/migration_toolkit_for_virtualization | all versions | — |
| redhat/network_observability_operator | all versions | — |
| redhat/node_healthcheck_operator | all versions | — |
| redhat/node_maintenance_operator | all versions | — |
| redhat/openshift | all versions | — |
| redhat/openshift_api_for_data_protection | all versions | — |
| redhat/openshift_container_platform | all versions | — |
| redhat/openshift_container_platform_assisted_installer | all versions | — |
| redhat/openshift_data_science | all versions | — |
| redhat/openshift_dev_spaces | all versions | — |
| redhat/openshift_developer_tools_and_services | all versions | — |
| redhat/openshift_distributed_tracing | all versions | — |
| redhat/openshift_gitops | all versions | — |
| redhat/openshift_pipelines | all versions | — |
| redhat/openshift_sandboxed_containers | all versions | — |
| redhat/openshift_secondary_scheduler_operator | all versions | — |
| redhat/openshift_serverless | all versions | — |
| redhat/openshift_service_mesh | all versions | — |
| redhat/openshift_virtualization | all versions | — |
| redhat/openstack_platform | all versions | — |
| redhat/openstack_platform | all versions | — |
| redhat/openstack_platform | all versions | — |
| redhat/process_automation | all versions | — |
| redhat/quay | all versions | — |
| redhat/run_once_duration_override_operator | all versions | — |
| redhat/satellite | all versions | — |
| redhat/self_node_remediation_operator | all versions | — |
| redhat/service_interconnect | all versions | — |
| redhat/single_sign-on | all versions | — |
| redhat/support_for_spring_boot | all versions | — |
| redhat/web_terminal | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/service_telemetry_framework | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| netapp/astra_control_center | all versions | — |
| netapp/oncommand_insight | all versions | — |
| akka/http_server | < 10.5.3 | 10.5.3 |
| konghq/kong_gateway | < 3.4.2 | 3.4.2 |
| jenkins/jenkins | ≤ 2.414.2 | — |
| jenkins/jenkins | ≤ 2.427 | — |
| apache/solr | < 9.4.0 | 9.4.0 |
| openresty/openresty | < 1.21.4.3 | 1.21.4.3 |
| cisco/business_process_automation | < 3.2.003.009 | 3.2.003.009 |
| cisco/connected_mobile_experiences | < 11.1 | 11.1 |
| cisco/crosswork_data_gateway | < 4.1.3 | 4.1.3 |
| cisco/crosswork_data_gateway | ≥ 5.0.0, < 5.0.2 | 5.0.2 |
| cisco/crosswork_situation_manager | all versions | — |
| cisco/crosswork_zero_touch_provisioning | < 6.0.0 | 6.0.0 |
| cisco/data_center_network_manager | all versions | — |
| cisco/enterprise_chat_and_email | all versions | — |
| cisco/expressway | < x14.3.3 | x14.3.3 |
| cisco/iot_field_network_director | < 4.11.0 | 4.11.0 |
| cisco/prime_access_registrar | < 9.3.3 | 9.3.3 |
| cisco/prime_cable_provisioning | < 7.2.1 | 7.2.1 |
| cisco/prime_infrastructure | < 3.10.4 | 3.10.4 |
| cisco/prime_network_registrar | < 11.2 | 11.2 |
| cisco/secure_dynamic_attributes_connector | < 2.2.0 | 2.2.0 |
| cisco/secure_firewall_threat_defense | < 7.4.2 | 7.4.2 |
| cisco/secure_malware_analytics | < 2.19.2 | 2.19.2 |
| cisco/telepresence_video_communication_server | < x14.3.3 | x14.3.3 |
| cisco/ultra_cloud_core_-_policy_control_function | < 2024.01.0 | 2024.01.0 |
| cisco/ultra_cloud_core_-_policy_control_function | all versions | — |
| cisco/ultra_cloud_core_-_serving_gateway_function | < 2024.02.0 | 2024.02.0 |
| cisco/ultra_cloud_core_-_session_management_function | < 2024.02.0 | 2024.02.0 |
| cisco/unified_attendant_console_advanced | all versions | — |
| cisco/unified_contact_center_domain_manager | all versions | — |
| cisco/unified_contact_center_enterprise | all versions | — |
| cisco/unified_contact_center_enterprise_-_live_data_server | < 12.6.2 | 12.6.2 |
| cisco/unified_contact_center_management_portal | all versions | — |
| cisco/fog_director | < 1.22 | 1.22 |
| cisco/ios_xe | < 17.15.1 | 17.15.1 |
| cisco/ios_xr | < 7.11.2 | 7.11.2 |
| cisco/secure_web_appliance_firmware | < 15.1.0 | 15.1.0 |
| cisco/nx-os | < 10.2\(7\) | 10.2\(7\) |
| cisco/nx-os | ≥ 10.3\(1\), < 10.3\(5\) | 10.3\(5\) |
| cisco/nx-os | ≥ 10.4\(1\), < 10.4\(2\) | 10.4\(2\) |
| cisco/nx-os | < 10.2\(7\) | 10.2\(7\) |
| cisco/nx-os | ≥ 10.3\(1\), < 10.3\(5\) | 10.3\(5\) |
| cisco/nx-os | ≥ 10.4\(1\), < 10.4\(2\) | 10.4\(2\) |