CVEFinder.io

CVE-2023-44487

⚠️ high
Summary

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS Score
7.5
High
EPSS Score
94.4
Exploit Probability
Published Date
2023-10-10
First Seen: 2026-01-05
Last Modified 2025-11-07
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE IDs (Weakness Types)

🔗 References 287

https://arstechnica.com/security/2023/10/how-ddosers...
Press/Media Coverage Third Party Advisory
https://blog.cloudflare.com/technical-breakdown-http...
Technical Description Vendor Advisory
https://blog.qualys.com/vulnerabilities-threat-resea...
Press/Media Coverage Third Party Advisory
https://bugzilla.proxmox.com/show_bug.cgi?id=4988
Issue Tracking Third Party Advisory
https://cloud.google.com/blog/products/identity-secu...
Technical Description Vendor Advisory
https://cloud.google.com/blog/products/identity-secu...
Technical Description Vendor Advisory
https://github.com/dotnet/announcements/issues/277
Issue Tracking Mitigation Vendor Advisory
https://groups.google.com/g/golang-announce/c/iNNxDT...
Mailing List Release Notes Vendor Advisory
https://mailman.nginx.org/pipermail/nginx-devel/2023...
Mailing List Patch Third Party Advisory
https://news.ycombinator.com/item?id=37830998
Issue Tracking Press/Media Coverage
https://www.cisa.gov/news-events/alerts/2023/10/10/h...
Third Party Advisory US Government Resource
https://www.darkreading.com/cloud/internet-wide-zero...
Press/Media Coverage Third Party Advisory
https://www.debian.org/security/2023/dsa-5540
Mailing List Third Party Advisory
https://www.debian.org/security/2023/dsa-5549
Mailing List Third Party Advisory
https://www.debian.org/security/2023/dsa-5558
Mailing List Third Party Advisory
https://www.theregister.com/2023/10/10/http2_rapid_r...
Press/Media Coverage Third Party Advisory
https://arstechnica.com/security/2023/10/how-ddosers...
Press/Media Coverage Third Party Advisory
https://blog.cloudflare.com/technical-breakdown-http...
Technical Description Vendor Advisory
https://blog.qualys.com/vulnerabilities-threat-resea...
Press/Media Coverage Third Party Advisory
https://bugzilla.proxmox.com/show_bug.cgi?id=4988
Issue Tracking Third Party Advisory
https://cloud.google.com/blog/products/identity-secu...
Technical Description Vendor Advisory
https://cloud.google.com/blog/products/identity-secu...
Technical Description Vendor Advisory
https://github.com/dotnet/announcements/issues/277
Issue Tracking Mitigation Vendor Advisory
https://groups.google.com/g/golang-announce/c/iNNxDT...
Mailing List Release Notes Vendor Advisory
https://mailman.nginx.org/pipermail/nginx-devel/2023...
Mailing List Patch Third Party Advisory
https://news.ycombinator.com/item?id=37830998
Issue Tracking Press/Media Coverage
https://www.cisa.gov/news-events/alerts/2023/10/10/h...
Third Party Advisory US Government Resource
https://www.darkreading.com/cloud/internet-wide-zero...
Press/Media Coverage Third Party Advisory
https://www.debian.org/security/2023/dsa-5540
Mailing List Third Party Advisory
https://www.debian.org/security/2023/dsa-5549
Mailing List Third Party Advisory
https://www.debian.org/security/2023/dsa-5558
Mailing List Third Party Advisory
https://www.theregister.com/2023/10/10/http2_rapid_r...
Press/Media Coverage Third Party Advisory

📦 Affected Products 276

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2025-61726 ⚠️ high 7.5 0.0 The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query p... 2026-01-28
CVE-2025-61728 🔶 medium 6.5 0.0 archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is open... 2026-01-28
CVE-2025-61730 🔶 medium 5.3 0.0 During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instanc... 2026-01-28
CVE-2025-61731 ⚠️ high 7.8 0.0 Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of... 2026-01-28
CVE-2025-68119 ⚠️ high 7.0 0.0 Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercuria... 2026-01-28
CVE-2025-68670 ⛔ critical 9.1 0.3 xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerabi... 2026-01-27
These CVEs affect the same products