CVE-2023-44487 : The HTTP/2 protocol allows a denial of service (server resource consumption) bec

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Published 2023-10-10 14:15:11

Updated 2024-12-20 17:40:52

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2023-44487

Cisco » Ios Xr
Versions before (<) 7.11.2
cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*
Matching versions
Cisco » Unified Contact Center Enterprise » Version: N/A
cpe:2.3:a:cisco:unified_contact_center_enterprise:-:*:*:*:*:*:*:*
Matching versions
Cisco » Ios Xe
Versions before (<) 17.15.1
cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*
Matching versions
Cisco » Nx-os
Versions from including (>=) 10.3\(1\) and before (<) 10.3\(5\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 3016 » Version: N/A
When used together with: Cisco » Nexus 3016q » Version: N/A
When used together with: Cisco » Nexus 3048 » Version: N/A
When used together with: Cisco » Nexus 3064 » Version: N/A
When used together with: Cisco » Nexus 3064-32t » Version: N/A
When used together with: Cisco » Nexus 3064-t » Version: N/A
When used together with: Cisco » Nexus 3064-x » Version: N/A
When used together with: Cisco » Nexus 3064t » Version: N/A
When used together with: Cisco » Nexus 3064x » Version: N/A
When used together with: Cisco » Nexus 3100 » Version: N/A
When used together with: Cisco » Nexus 3100-v » Version: N/A
When used together with: Cisco » Nexus 3100-z » Version: N/A
When used together with: Cisco » Nexus 3100v » Version: N/A
When used together with: Cisco » Nexus 31108pc-v » Version: N/A
When used together with: Cisco » Nexus 31108pv-v » Version: N/A
When used together with: Cisco » Nexus 31108tc-v » Version: N/A
When used together with: Cisco » Nexus 31128pq » Version: N/A
When used together with: Cisco » Nexus 3132c-z » Version: N/A
When used together with: Cisco » Nexus 3132q » Version: N/A
When used together with: Cisco » Nexus 3132q-v » Version: N/A
When used together with: Cisco » Nexus 3132q-x » Version: N/A
When used together with: Cisco » Nexus 3132q-x/3132q-xl » Version: N/A
When used together with: Cisco » Nexus 3132q-xl » Version: N/A
When used together with: Cisco » Nexus 3164q » Version: N/A
When used together with: Cisco » Nexus 3172 » Version: N/A
When used together with: Cisco » Nexus 3172pq » Version: N/A
When used together with: Cisco » Nexus 3172pq-xl » Version: N/A
When used together with: Cisco » Nexus 3172pq/pq-xl » Version: N/A
When used together with: Cisco » Nexus 3172tq » Version: N/A
When used together with: Cisco » Nexus 3172tq-32t » Version: N/A
When used together with: Cisco » Nexus 3172tq-xl » Version: N/A
When used together with: Cisco » Nexus 3200 » Version: N/A
When used together with: Cisco » Nexus 3232 » Version: N/A
When used together with: Cisco » Nexus 3232c » Version: N/A
When used together with: Cisco » Nexus 3232c » Version: N/A
When used together with: Cisco » Nexus 3264c-e » Version: N/A
When used together with: Cisco » Nexus 3264q » Version: N/A
When used together with: Cisco » Nexus 3400 » Version: N/A
When used together with: Cisco » Nexus 3408-s » Version: N/A
When used together with: Cisco » Nexus 34180yc » Version: N/A
When used together with: Cisco » Nexus 34200yc-sm » Version: N/A
When used together with: Cisco » Nexus 3432d-s » Version: N/A
When used together with: Cisco » Nexus 3464c » Version: N/A
When used together with: Cisco » Nexus 3500 » Version: N/A
When used together with: Cisco » Nexus 3524 » Version: N/A
When used together with: Cisco » Nexus 3524-x » Version: N/A
When used together with: Cisco » Nexus 3524-x/xl » Version: N/A
When used together with: Cisco » Nexus 3524-xl » Version: N/A
When used together with: Cisco » Nexus 3548 » Version: N/A
When used together with: Cisco » Nexus 3548-x » Version: N/A
When used together with: Cisco » Nexus 3548-x/xl » Version: N/A
When used together with: Cisco » Nexus 3548-xl » Version: N/A
When used together with: Cisco » Nexus 3600 » Version: N/A
When used together with: Cisco » Nexus 36180yc-r » Version: N/A
When used together with: Cisco » Nexus 3636c-r » Version: N/A
Cisco » Nx-os
Versions before (<) 10.2\(7\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 3016 » Version: N/A
When used together with: Cisco » Nexus 3016q » Version: N/A
When used together with: Cisco » Nexus 3048 » Version: N/A
When used together with: Cisco » Nexus 3064 » Version: N/A
When used together with: Cisco » Nexus 3064-32t » Version: N/A
When used together with: Cisco » Nexus 3064-t » Version: N/A
When used together with: Cisco » Nexus 3064-x » Version: N/A
When used together with: Cisco » Nexus 3064t » Version: N/A
When used together with: Cisco » Nexus 3064x » Version: N/A
When used together with: Cisco » Nexus 3100 » Version: N/A
When used together with: Cisco » Nexus 3100-v » Version: N/A
When used together with: Cisco » Nexus 3100-z » Version: N/A
When used together with: Cisco » Nexus 3100v » Version: N/A
When used together with: Cisco » Nexus 31108pc-v » Version: N/A
When used together with: Cisco » Nexus 31108pv-v » Version: N/A
When used together with: Cisco » Nexus 31108tc-v » Version: N/A
When used together with: Cisco » Nexus 31128pq » Version: N/A
When used together with: Cisco » Nexus 3132c-z » Version: N/A
When used together with: Cisco » Nexus 3132q » Version: N/A
When used together with: Cisco » Nexus 3132q-v » Version: N/A
When used together with: Cisco » Nexus 3132q-x » Version: N/A
When used together with: Cisco » Nexus 3132q-x/3132q-xl » Version: N/A
When used together with: Cisco » Nexus 3132q-xl » Version: N/A
When used together with: Cisco » Nexus 3164q » Version: N/A
When used together with: Cisco » Nexus 3172 » Version: N/A
When used together with: Cisco » Nexus 3172pq » Version: N/A
When used together with: Cisco » Nexus 3172pq-xl » Version: N/A
When used together with: Cisco » Nexus 3172pq/pq-xl » Version: N/A
When used together with: Cisco » Nexus 3172tq » Version: N/A
When used together with: Cisco » Nexus 3172tq-32t » Version: N/A
When used together with: Cisco » Nexus 3172tq-xl » Version: N/A
When used together with: Cisco » Nexus 3200 » Version: N/A
When used together with: Cisco » Nexus 3232 » Version: N/A
When used together with: Cisco » Nexus 3232c » Version: N/A
When used together with: Cisco » Nexus 3232c » Version: N/A
When used together with: Cisco » Nexus 3264c-e » Version: N/A
When used together with: Cisco » Nexus 3264q » Version: N/A
When used together with: Cisco » Nexus 3400 » Version: N/A
When used together with: Cisco » Nexus 3408-s » Version: N/A
When used together with: Cisco » Nexus 34180yc » Version: N/A
When used together with: Cisco » Nexus 34200yc-sm » Version: N/A
When used together with: Cisco » Nexus 3432d-s » Version: N/A
When used together with: Cisco » Nexus 3464c » Version: N/A
When used together with: Cisco » Nexus 3500 » Version: N/A
When used together with: Cisco » Nexus 3524 » Version: N/A
When used together with: Cisco » Nexus 3524-x » Version: N/A
When used together with: Cisco » Nexus 3524-x/xl » Version: N/A
When used together with: Cisco » Nexus 3524-xl » Version: N/A
When used together with: Cisco » Nexus 3548 » Version: N/A
When used together with: Cisco » Nexus 3548-x » Version: N/A
When used together with: Cisco » Nexus 3548-x/xl » Version: N/A
When used together with: Cisco » Nexus 3548-xl » Version: N/A
When used together with: Cisco » Nexus 3600 » Version: N/A
When used together with: Cisco » Nexus 36180yc-r » Version: N/A
When used together with: Cisco » Nexus 3636c-r » Version: N/A
Cisco » Prime Infrastructure
Versions before (<) 3.10.4
cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:*
Matching versions
Cisco » Prime Network Registrar
Versions before (<) 11.2
cpe:2.3:a:cisco:prime_network_registrar:*:*:*:*:*:*:*:*
Matching versions
Cisco » Telepresence Video Communication Server
Versions before (<) x14.3.3
cpe:2.3:a:cisco:telepresence_video_communication_server:*:*:*:*:*:*:*:*
Matching versions
Cisco » Expressway
Versions before (<) x14.3.3
cpe:2.3:a:cisco:expressway:*:*:*:*:*:*:*:*
Matching versions
Cisco » Firepower Threat Defense
Versions before (<) 7.4.2
cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*
Matching versions
Cisco » Data Center Network Manager » Version: N/A
cpe:2.3:a:cisco:data_center_network_manager:-:*:*:*:*:*:*:*
Matching versions
Cisco » Iot Field Network Director
Versions before (<) 4.11.0
cpe:2.3:a:cisco:iot_field_network_director:*:*:*:*:*:*:*:*
Matching versions
Cisco » Enterprise Chat And Email » Version: N/A
cpe:2.3:a:cisco:enterprise_chat_and_email:-:*:*:*:*:*:*:*
Matching versions
Cisco » Connected Mobile Experiences
Versions before (<) 11.1
cpe:2.3:a:cisco:connected_mobile_experiences:*:*:*:*:*:*:*:*
Matching versions
Cisco » Prime Access Registrar
Versions before (<) 9.3.3
cpe:2.3:a:cisco:prime_access_registrar:*:*:*:*:*:*:*:*
Matching versions
Cisco » Crosswork Data Gateway
Versions before (<) 4.1.3
cpe:2.3:a:cisco:crosswork_data_gateway:*:*:*:*:*:*:*:*
Matching versions
Cisco » Crosswork Data Gateway » Version: 5.0
cpe:2.3:a:cisco:crosswork_data_gateway:5.0:*:*:*:*:*:*:*
Matching versions
Cisco » Crosswork Zero Touch Provisioning
Versions before (<) 6.0.0
cpe:2.3:a:cisco:crosswork_zero_touch_provisioning:*:*:*:*:*:*:*:*
Matching versions
Cisco » Unified Contact Center Management Portal » Version: N/A
cpe:2.3:a:cisco:unified_contact_center_management_portal:-:*:*:*:*:*:*:*
Matching versions
Cisco » Prime Cable Provisioning
Versions before (<) 7.2.1
cpe:2.3:a:cisco:prime_cable_provisioning:*:*:*:*:*:*:*:*
Matching versions
Cisco » Secure Dynamic Attributes Connector
Versions before (<) 2.2.0
cpe:2.3:a:cisco:secure_dynamic_attributes_connector:*:*:*:*:*:*:*:*
Matching versions
Cisco » Secure Malware Analytics
Versions before (<) 2.19.2
cpe:2.3:a:cisco:secure_malware_analytics:*:*:*:*:*:*:*:*
Matching versions
Cisco » Ultra Cloud Core - Policy Control Function
Versions before (<) 2024.01.0
cpe:2.3:a:cisco:ultra_cloud_core_-_policy_control_function:*:*:*:*:*:*:*:*
Matching versions
Cisco » Ultra Cloud Core - Policy Control Function » Version: 2024.01.0
cpe:2.3:a:cisco:ultra_cloud_core_-_policy_control_function:2024.01.0:*:*:*:*:*:*:*
Matching versions
Cisco » Ultra Cloud Core - Serving Gateway Function
Versions before (<) 2024.02.0
cpe:2.3:a:cisco:ultra_cloud_core_-_serving_gateway_function:*:*:*:*:*:*:*:*
Matching versions
Cisco » Ultra Cloud Core - Session Management Function
Versions before (<) 2024.02.0
cpe:2.3:a:cisco:ultra_cloud_core_-_session_management_function:*:*:*:*:*:*:*:*
Matching versions
Cisco » Unified Attendant Console Advanced » Version: N/A
cpe:2.3:a:cisco:unified_attendant_console_advanced:-:*:*:*:*:*:*:*
Matching versions
Cisco » Unified Contact Center Domain Manager » Version: N/A
cpe:2.3:a:cisco:unified_contact_center_domain_manager:-:*:*:*:*:*:*:*
Matching versions
Cisco » Unified Contact Center Enterprise - Live Data Server
Versions before (<) 12.6.2
cpe:2.3:a:cisco:unified_contact_center_enterprise_-_live_data_server:*:*:*:*:*:*:*:*
Matching versions
Cisco » Fog Director
Versions before (<) 1.22
cpe:2.3:o:cisco:fog_director:*:*:*:*:*:*:*:*
Matching versions
Cisco » Secure Web Appliance Firmware
Versions before (<) 15.1.0
cpe:2.3:o:cisco:secure_web_appliance_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Secure Web Appliance » Version: N/A
Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 11.0
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 12.0
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 8.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 9.0
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Matching versions
Redhat » Jboss Enterprise Application Platform » Version: 6.0.0
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*
Matching versions
Redhat » Jboss Enterprise Application Platform » Version: 7.0.0
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift » Version: N/A For AWS
cpe:2.3:a:redhat:openshift:-:*:*:*:*:aws:*:*
Matching versions
Redhat » Jboss Fuse » Version: 6.0.0
cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*
Matching versions
Redhat » Jboss Fuse » Version: 7.0.0
cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*
Matching versions
Redhat » Jboss A-mq » Version: 7
cpe:2.3:a:redhat:jboss_a-mq:7:*:*:*:*:*:*:*
Matching versions
Redhat » Satellite » Version: 6.0
cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Ceph Storage » Version: 5.0
cpe:2.3:a:redhat:ceph_storage:5.0:*:*:*:*:*:*:*
Matching versions
Redhat » 3scale Api Management Platform » Version: 2.0
cpe:2.3:a:redhat:3scale_api_management_platform:2.0:*:*:*:*:*:*:*
Matching versions
Redhat » Openstack Platform » Version: 16.1
cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:*
Matching versions
Redhat » Openstack Platform » Version: 16.2
cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:*
Matching versions
Redhat » Openstack Platform » Version: 17.1
cpe:2.3:a:redhat:openstack_platform:17.1:*:*:*:*:*:*:*
Matching versions
Redhat » Jboss Data Grid » Version: 7.0.0
cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Container Platform » Version: 4.0
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
Matching versions
Redhat » Decision Manager » Version: 7.0
cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Jboss Core Services » Version: N/A
cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:*
Matching versions
Redhat » Single Sign-on » Version: 7.0
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Quay » Version: 3.0.0
cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*
Matching versions
Redhat » Process Automation » Version: 7.0
cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Service Mesh » Version: 2.0
cpe:2.3:a:redhat:openshift_service_mesh:2.0:*:*:*:*:*:*:*
Matching versions
Redhat » Build Of Quarkus » Version: N/A
cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:*
Matching versions
Redhat » Integration Camel K » Version: N/A
cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*
Matching versions
Redhat » Ansible Automation Platform » Version: 2.0
cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Virtualization » Version: 4
cpe:2.3:a:redhat:openshift_virtualization:4:*:*:*:*:*:*:*
Matching versions
Redhat » Advanced Cluster Management For Kubernetes » Version: 2.0
cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:*
Matching versions
Redhat » Integration Service Registry » Version: N/A
cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Gitops » Version: N/A
cpe:2.3:a:redhat:openshift_gitops:-:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Serverless » Version: N/A
cpe:2.3:a:redhat:openshift_serverless:-:*:*:*:*:*:*:*
Matching versions
Redhat » Advanced Cluster Security » Version: 3.0
cpe:2.3:a:redhat:advanced_cluster_security:3.0:*:*:*:*:*:*:*
Matching versions
Redhat » Advanced Cluster Security » Version: 4.0
cpe:2.3:a:redhat:advanced_cluster_security:4.0:*:*:*:*:*:*:*
Matching versions
Redhat » Integration Camel For Spring Boot » Version: N/A
cpe:2.3:a:redhat:integration_camel_for_spring_boot:-:*:*:*:*:*:*:*
Matching versions
Redhat » Migration Toolkit For Applications » Version: 6.0
cpe:2.3:a:redhat:migration_toolkit_for_applications:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Developer Tools And Services » Version: N/A
cpe:2.3:a:redhat:openshift_developer_tools_and_services:-:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Api For Data Protection » Version: N/A
cpe:2.3:a:redhat:openshift_api_for_data_protection:-:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Data Science » Version: N/A
cpe:2.3:a:redhat:openshift_data_science:-:*:*:*:*:*:*:*
Matching versions
Redhat » Build Of Optaplanner » Version: 8.0
cpe:2.3:a:redhat:build_of_optaplanner:8.0:*:*:*:*:*:*:*
Matching versions
Redhat » Cert-manager Operator For Red Hat Openshift » Version: N/A
cpe:2.3:a:redhat:cert-manager_operator_for_red_hat_openshift:-:*:*:*:*:*:*:*
Matching versions
Redhat » Certification For Red Hat Enterprise Linux » Version: 8.0
cpe:2.3:a:redhat:certification_for_red_hat_enterprise_linux:8.0:*:*:*:*:*:*:*
Matching versions
Redhat » Certification For Red Hat Enterprise Linux » Version: 9.0
cpe:2.3:a:redhat:certification_for_red_hat_enterprise_linux:9.0:*:*:*:*:*:*:*
Matching versions
Redhat » Cost Management » Version: N/A
cpe:2.3:a:redhat:cost_management:-:*:*:*:*:*:*:*
Matching versions
Redhat » Cryostat » Version: 2.0
cpe:2.3:a:redhat:cryostat:2.0:*:*:*:*:*:*:*
Matching versions
Redhat » Fence Agents Remediation Operator » Version: N/A
cpe:2.3:a:redhat:fence_agents_remediation_operator:-:*:*:*:*:*:*:*
Matching versions
Redhat » Jboss A-mq Streams » Version: N/A
cpe:2.3:a:redhat:jboss_a-mq_streams:-:*:*:*:*:*:*:*
Matching versions
Redhat » Logging Subsystem For Red Hat Openshift » Version: N/A
cpe:2.3:a:redhat:logging_subsystem_for_red_hat_openshift:-:*:*:*:*:*:*:*
Matching versions
Redhat » Machine Deletion Remediation Operator » Version: N/A
cpe:2.3:a:redhat:machine_deletion_remediation_operator:-:*:*:*:*:*:*:*
Matching versions
Redhat » Migration Toolkit For Containers » Version: N/A
cpe:2.3:a:redhat:migration_toolkit_for_containers:-:*:*:*:*:*:*:*
Matching versions
Redhat » Migration Toolkit For Virtualization » Version: N/A
cpe:2.3:a:redhat:migration_toolkit_for_virtualization:-:*:*:*:*:*:*:*
Matching versions
Redhat » Network Observability Operator » Version: N/A
cpe:2.3:a:redhat:network_observability_operator:-:*:*:*:*:*:*:*
Matching versions
Redhat » Node Healthcheck Operator » Version: N/A
cpe:2.3:a:redhat:node_healthcheck_operator:-:*:*:*:*:*:*:*
Matching versions
Redhat » Node Maintenance Operator » Version: N/A
cpe:2.3:a:redhat:node_maintenance_operator:-:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Container Platform Assisted Installer » Version: N/A
cpe:2.3:a:redhat:openshift_container_platform_assisted_installer:-:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Dev Spaces » Version: N/A
cpe:2.3:a:redhat:openshift_dev_spaces:-:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Distributed Tracing » Version: N/A
cpe:2.3:a:redhat:openshift_distributed_tracing:-:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Pipelines » Version: N/A
cpe:2.3:a:redhat:openshift_pipelines:-:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Sandboxed Containers » Version: N/A
cpe:2.3:a:redhat:openshift_sandboxed_containers:-:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Secondary Scheduler Operator » Version: N/A
cpe:2.3:a:redhat:openshift_secondary_scheduler_operator:-:*:*:*:*:*:*:*
Matching versions
Redhat » Run Once Duration Override Operator » Version: N/A
cpe:2.3:a:redhat:run_once_duration_override_operator:-:*:*:*:*:*:*:*
Matching versions
Redhat » Self Node Remediation Operator » Version: N/A
cpe:2.3:a:redhat:self_node_remediation_operator:-:*:*:*:*:*:*:*
Matching versions
Redhat » Service Interconnect » Version: 1.0
cpe:2.3:a:redhat:service_interconnect:1.0:*:*:*:*:*:*:*
Matching versions
Redhat » Support For Spring Boot » Version: N/A
cpe:2.3:a:redhat:support_for_spring_boot:-:*:*:*:*:*:*:*
Matching versions
Redhat » Web Terminal » Version: N/A
cpe:2.3:a:redhat:web_terminal:-:*:*:*:*:*:*:*
Matching versions
Redhat » Service Telemetry Framework » Version: 1.5
cpe:2.3:a:redhat:service_telemetry_framework:1.5:*:*:*:*:*:*:*
Matching versions
When used together with: Redhat » Enterprise Linux » Version: 8.0
Microsoft » Windows Server 2016 » Version: N/A
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Asp.net Core
Versions from including (>=) 7.0.0 and before (<) 7.0.12
cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Asp.net Core
Versions from including (>=) 6.0.0 and before (<) 6.0.23
cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2019 » Version: N/A
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Azure Kubernetes Service
Versions before (<) 2023-10-08
cpe:2.3:a:microsoft:azure_kubernetes_service:*:*:*:*:*:*:*:*
Matching versions
Microsoft » .net
Versions from including (>=) 6.0.0 and before (<) 6.0.23
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
Matching versions
Microsoft » .net
Versions from including (>=) 7.0.0 and before (<) 7.0.12
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2022 » Version: N/A
cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Visual Studio 2022
Versions from including (>=) 17.0 and before (<) 17.2.20
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Visual Studio 2022
Versions from including (>=) 17.7 and before (<) 17.7.5
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Visual Studio 2022
Versions from including (>=) 17.4 and before (<) 17.4.12
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Visual Studio 2022
Versions from including (>=) 17.6 and before (<) 17.6.8
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 11 21h2
Versions before (<) 10.0.22000.2538
cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 11 22h2
Versions before (<) 10.0.22621.2428
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 1607 » For X64
Versions before (<) 10.0.14393.6351
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
Matching versions
Microsoft » Windows 10 1607 » For X86
Versions before (<) 10.0.14393.6351
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
Matching versions
Microsoft » Windows 10 1809
Versions before (<) 10.0.17763.4974
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 21h2
Versions before (<) 10.0.19044.3570
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 22h2
Versions before (<) 10.0.19045.3570
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Cbl-mariner
Versions before (<) 2023-10-11
cpe:2.3:a:microsoft:cbl-mariner:*:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat
Versions from including (>=) 10.1.0 and up to, including, (<=) 10.1.13
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat
Versions from including (>=) 8.5.0 and up to, including, (<=) 8.5.93
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat
Versions from including (>=) 9.0.0 and up to, including, (<=) 9.0.80
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 11.0.0 Update Milestone1
cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 11.0.0 Update Milestone2
cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 11.0.0 Update Milestone4
cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 11.0.0 Update Milestone3
cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 11.0.0 Update Milestone5
cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 11.0.0 Update Milestone6
cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 11.0.0 Update Milestone10
cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 11.0.0 Update Milestone7
cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 11.0.0 Update Milestone8
cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 11.0.0 Update Milestone9
cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 11.0.0 Update Milestone11
cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*
Matching versions
Apache » Solr
Versions before (<) 9.4.0
cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*
Matching versions
Apache » Traffic Server
Versions from including (>=) 9.0.0 and before (<) 9.2.3
cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
Matching versions
Apache » Traffic Server
Versions from including (>=) 8.0.0 and before (<) 8.1.9
cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
Matching versions
Apache » Apisix
Versions before (<) 3.6.1
cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*
Matching versions
Apple » Swiftnio Http/2 » For Swift
Versions before (<) 1.28.0
cpe:2.3:a:apple:swiftnio_http\/2:*:*:*:*:*:swift:*:*
Matching versions
F5 » Big-ip Local Traffic Manager
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Local Traffic Manager
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.10
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Local Traffic Manager
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.4
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Local Traffic Manager
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Local Traffic Manager » Version: 17.1.0
cpe:2.3:a:f5:big-ip_local_traffic_manager:17.1.0:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Global Traffic Manager
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.4
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Global Traffic Manager
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Global Traffic Manager
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.10
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Global Traffic Manager
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Global Traffic Manager » Version: 17.1.0
cpe:2.3:a:f5:big-ip_global_traffic_manager:17.1.0:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Application Security Manager
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.10
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Application Security Manager
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.4
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Application Security Manager
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Application Security Manager
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Application Security Manager » Version: 17.1.0
cpe:2.3:a:f5:big-ip_application_security_manager:17.1.0:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Access Policy Manager
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.10
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Access Policy Manager
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Access Policy Manager
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.4
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Access Policy Manager
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Access Policy Manager » Version: 17.1.0
cpe:2.3:a:f5:big-ip_access_policy_manager:17.1.0:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Webaccelerator
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Webaccelerator
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.10
cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Webaccelerator
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.4
cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Webaccelerator
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Webaccelerator » Version: 17.1.0
cpe:2.3:a:f5:big-ip_webaccelerator:17.1.0:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Link Controller
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.10
cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Link Controller
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.4
cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Link Controller
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Link Controller
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Link Controller » Version: 17.1.0
cpe:2.3:a:f5:big-ip_link_controller:17.1.0:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Analytics
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.4
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Analytics
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Analytics
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.10
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Analytics
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Analytics » Version: 17.1.0
cpe:2.3:a:f5:big-ip_analytics:17.1.0:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Application Acceleration Manager
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.4
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Application Acceleration Manager
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Application Acceleration Manager
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Application Acceleration Manager
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.10
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Application Acceleration Manager » Version: 17.1.0
cpe:2.3:a:f5:big-ip_application_acceleration_manager:17.1.0:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Advanced Firewall Manager
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.10
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Advanced Firewall Manager
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Advanced Firewall Manager
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Advanced Firewall Manager
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.4
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Advanced Firewall Manager » Version: 17.1.0
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.1.0:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Policy Enforcement Manager
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Policy Enforcement Manager
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Policy Enforcement Manager
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.4
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Policy Enforcement Manager
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.10
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Policy Enforcement Manager » Version: 17.1.0
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:17.1.0:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Domain Name System
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Domain Name System
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.10
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Domain Name System
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.4
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Domain Name System
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Domain Name System » Version: 17.1.0
cpe:2.3:a:f5:big-ip_domain_name_system:17.1.0:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Websafe
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Websafe
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Websafe
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.10
cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Websafe
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.4
cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Websafe » Version: 17.1.0
cpe:2.3:a:f5:big-ip_websafe:17.1.0:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Fraud Protection Service
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.10
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Fraud Protection Service
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Fraud Protection Service
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.4
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Fraud Protection Service
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Fraud Protection Service » Version: 17.1.0
cpe:2.3:a:f5:big-ip_fraud_protection_service:17.1.0:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Application Visibility And Reporting
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.10
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Application Visibility And Reporting
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.4
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Application Visibility And Reporting
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Application Visibility And Reporting
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Application Visibility And Reporting » Version: 17.1.0
cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:17.1.0:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Advanced Web Application Firewall
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Advanced Web Application Firewall
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Advanced Web Application Firewall
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.10
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Advanced Web Application Firewall
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.4
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Advanced Web Application Firewall » Version: 17.1.0
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:17.1.0:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Ddos Hybrid Defender
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Ddos Hybrid Defender
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.10
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Ddos Hybrid Defender
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.4
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Ddos Hybrid Defender
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Ddos Hybrid Defender » Version: 17.1.0
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:17.1.0:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Ssl Orchestrator
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Ssl Orchestrator
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.4
cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Ssl Orchestrator
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Ssl Orchestrator
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.10
cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Ssl Orchestrator » Version: 17.1.0
cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.1.0:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Carrier-grade Nat
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Carrier-grade Nat
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.4
cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Carrier-grade Nat
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Carrier-grade Nat
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.10
cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Carrier-grade Nat » Version: 17.1.0
cpe:2.3:a:f5:big-ip_carrier-grade_nat:17.1.0:*:*:*:*:*:*:*
Matching versions
F5 » Nginx
Versions from including (>=) 1.9.5 and up to, including, (<=) 1.25.2
cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*
Matching versions
F5 » Nginx Ingress Controller
Versions from including (>=) 2.0.0 and up to, including, (<=) 2.4.2
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*
Matching versions
F5 » Nginx Ingress Controller
Versions from including (>=) 3.0.0 and up to, including, (<=) 3.3.0
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*
Matching versions
F5 » Nginx Plus
Versions from including (>=) r25 and before (<) r29
cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*
Matching versions
F5 » Nginx Plus » Version: R29
cpe:2.3:a:f5:nginx_plus:r29:-:*:*:*:*:*:*
Matching versions
F5 » Nginx Plus » Version: R30
cpe:2.3:a:f5:nginx_plus:r30:-:*:*:*:*:*:*
Matching versions
F5 » Big-ip Next Service Proxy For Kubernetes
Versions from including (>=) 1.5.0 and up to, including, (<=) 1.8.2
cpe:2.3:a:f5:big-ip_next_service_proxy_for_kubernetes:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Next » Version: 20.0.1
cpe:2.3:a:f5:big-ip_next:20.0.1:*:*:*:*:*:*:*
Matching versions
Ietf » Http » Version: 2.0
cpe:2.3:a:ietf:http:2.0:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 37
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 38
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
Matching versions
Facebook » Proxygen
Versions before (<) 2023.10.16.00
cpe:2.3:a:facebook:proxygen:*:*:*:*:*:*:*:*
Matching versions
Netapp » Oncommand Insight » Version: N/A
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
Matching versions
Netapp » Astra Control Center » Version: N/A
cpe:2.3:a:netapp:astra_control_center:-:*:*:*:*:*:*:*
Matching versions
Eclipse » Jetty
Versions from including (>=) 11.0.0 and before (<) 11.0.17
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
Matching versions
Eclipse » Jetty
Versions before (<) 9.4.53
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
Matching versions
Eclipse » Jetty
Versions from including (>=) 10.0.0 and before (<) 10.0.17
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
Matching versions
Eclipse » Jetty
Versions from including (>=) 12.0.0 and before (<) 12.0.2
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
Matching versions
Nodejs » Node.js
Versions from including (>=) 20.0.0 and before (<) 20.8.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
Matching versions
Nodejs » Node.js » LTS Edition
Versions from including (>=) 18.0.0 and before (<) 18.18.2
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
Matching versions
Amazon » Opensearch Data Prepper
Versions before (<) 2.5.0
cpe:2.3:a:amazon:opensearch_data_prepper:*:*:*:*:*:*:*:*
Matching versions
Linecorp » Armeria
Versions before (<) 1.26.0
cpe:2.3:a:linecorp:armeria:*:*:*:*:*:*:*:*
Matching versions
Golang » GO
Versions before (<) 1.20.10
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Matching versions
Golang » GO
Versions from including (>=) 1.21.0 and before (<) 1.21.3
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Matching versions
Golang » Http2 » For GO
Versions before (<) 0.17.0
cpe:2.3:a:golang:http2:*:*:*:*:*:go:*:*
Matching versions
Golang » Networking » For GO
Versions before (<) 0.17.0
cpe:2.3:a:golang:networking:*:*:*:*:*:go:*:*
Matching versions
Dena » H2O
Versions before (<) 2023-10-10
cpe:2.3:a:dena:h2o:*:*:*:*:*:*:*:*
Matching versions
Nghttp2 » Nghttp2
Versions before (<) 1.57.0
cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*
Matching versions
Jenkins » Jenkins »
Versions up to, including, (<=) 2.427
cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*
Matching versions
Jenkins » Jenkins » LTS Edition
Versions up to, including, (<=) 2.414.2
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
Matching versions
Grpc » Grpc » For GO
Versions before (<) 1.56.3
cpe:2.3:a:grpc:grpc:*:*:*:*:*:go:*:*
Matching versions
Grpc » Grpc » For GO
Versions from including (>=) 1.58.0 and before (<) 1.58.3
cpe:2.3:a:grpc:grpc:*:*:*:*:*:go:*:*
Matching versions
Grpc » Grpc »
Versions up to, including, (<=) 1.59.2
cpe:2.3:a:grpc:grpc:*:*:*:*:*:-:*:*
Matching versions
Grpc » Grpc » Version: 1.57.0 For GO
cpe:2.3:a:grpc:grpc:1.57.0:-:*:*:*:go:*:*
Matching versions
Akka » Http Server
Versions before (<) 10.5.3
cpe:2.3:a:akka:http_server:*:*:*:*:*:*:*:*
Matching versions
Envoyproxy » Envoy » Version: 1.24.10
cpe:2.3:a:envoyproxy:envoy:1.24.10:*:*:*:*:*:*:*
Matching versions
Envoyproxy » Envoy » Version: 1.25.9
cpe:2.3:a:envoyproxy:envoy:1.25.9:*:*:*:*:*:*:*
Matching versions
Envoyproxy » Envoy » Version: 1.26.4
cpe:2.3:a:envoyproxy:envoy:1.26.4:*:*:*:*:*:*:*
Matching versions
Envoyproxy » Envoy » Version: 1.27.0
cpe:2.3:a:envoyproxy:envoy:1.27.0:*:*:*:*:*:*:*
Matching versions
Istio » Istio
Versions before (<) 1.17.6
cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*
Matching versions
Istio » Istio
Versions from including (>=) 1.19.0 and before (<) 1.19.1
cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*
Matching versions
Istio » Istio
Versions from including (>=) 1.18.0 and before (<) 1.18.3
cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*
Matching versions
Netty » Netty
Versions before (<) 4.1.100
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*
Matching versions
Caddyserver » Caddy
Versions before (<) 2.7.5
cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*
Matching versions
Openresty » Openresty
Versions before (<) 1.21.4.3
cpe:2.3:a:openresty:openresty:*:*:*:*:*:*:*:*
Matching versions
Konghq » Kong Gateway » Enterprise Edition
Versions before (<) 3.4.2
cpe:2.3:a:konghq:kong_gateway:*:*:*:*:enterprise:*:*:*
Matching versions
Projectcontour » Contour » For Kubernetes
Versions before (<) 2023-10-11
cpe:2.3:a:projectcontour:contour:*:*:*:*:*:kubernetes:*:*
Matching versions
Traefik » Traefik
Versions before (<) 2.10.5
cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*
Matching versions
Traefik » Traefik » Version: 3.0.0 Update Beta1
cpe:2.3:a:traefik:traefik:3.0.0:beta1:*:*:*:*:*:*
Matching versions
Traefik » Traefik » Version: 3.0.0 Update Beta2
cpe:2.3:a:traefik:traefik:3.0.0:beta2:*:*:*:*:*:*
Matching versions
Traefik » Traefik » Version: 3.0.0 Update Beta3
cpe:2.3:a:traefik:traefik:3.0.0:beta3:*:*:*:*:*:*
Matching versions
Varnish Cache Project » Varnish Cache
Versions before (<) 2023-10-10
cpe:2.3:a:varnish_cache_project:varnish_cache:*:*:*:*:*:*:*:*
Matching versions
Kazu-yamamoto » Http2
Versions before (<) 4.2.2
cpe:2.3:a:kazu-yamamoto:http2:*:*:*:*:*:*:*:*
Matching versions
Linkerd » Linkerd » Stable Edition For Kubernetes
Versions from including (>=) 2.12.0 and up to, including, (<=) 2.12.5
cpe:2.3:a:linkerd:linkerd:*:*:*:*:stable:kubernetes:*:*
Matching versions
Linkerd » Linkerd » Version: 2.13.0 Stable Edition For Kubernetes
cpe:2.3:a:linkerd:linkerd:2.13.0:*:*:*:stable:kubernetes:*:*
Matching versions
Linkerd » Linkerd » Version: 2.13.1 Stable Edition For Kubernetes
cpe:2.3:a:linkerd:linkerd:2.13.1:*:*:*:stable:kubernetes:*:*
Matching versions
Linkerd » Linkerd » Version: 2.14.0 Stable Edition For Kubernetes
cpe:2.3:a:linkerd:linkerd:2.14.0:*:*:*:stable:kubernetes:*:*
Matching versions
Linkerd » Linkerd » Version: 2.14.1 Stable Edition For Kubernetes
cpe:2.3:a:linkerd:linkerd:2.14.1:*:*:*:stable:kubernetes:*:*
Matching versions

CVE-2023-44487 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

HTTP/2 Rapid Reset Attack Vulnerability

CISA required action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA description:

HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).

Notes:

This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-

Added on 2023-10-10 Action due date 2023-10-31

Exploit prediction scoring system (EPSS) score for CVE-2023-44487

EPSS FAQ

80.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-44487

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	134c704f-9b21-4f2e-91b3-4a467353bcc0	2024-08-01
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	N/A	N/A	RedHat-CVE-2023-44487
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2023-44487

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)

References for CVE-2023-44487

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/

[SECURITY] Fedora 37 Update: folly-2023.10.16.00-1.fc37 - package-announce - Fedora Mailing-Lists
https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61

Merge pull request from GHSA-xpw8-rcwv-8f8p · netty/netty@58f75f6 · GitHub
Patch
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/

[SECURITY] Fedora 38 Update: mod_http2-2.0.25-1.fc38 - package-announce - Fedora Mailing-Lists

CVEs referencing this url
https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q

ATS is vulnerable to a HTTP/2 and s3 auth plugin attacks-Apache Mail Archives
Mailing List

CVEs referencing this url
https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1

ver bump up · kazu-yamamoto/http2@f61d41a · GitHub
Patch
https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack

HTTP/2 "Rapid Reset" DDoS Attack Disclosed By Google, Cloudflare & AWS - Phoronix
Press/Media Coverage
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/

[SECURITY] Fedora 38 Update: mcrouter-0.41.0.20231016-1.fc38 - package-announce - Fedora Mailing-Lists
https://github.com/apache/apisix/issues/10320

help request: What's the action for CVE-2023-44487 ? · Issue #10320 · apache/apisix · GitHub
Issue Tracking
https://security.paloaltonetworks.com/CVE-2023-44487

CVE-2023-44487 Impact of Rapid Reset and HTTP/2 DoS Vulnerabilities (CVE-2023-44487, CVE-2023-35945)
Vendor Advisory
https://my.f5.com/manage/s/article/K000137106

HTTP/2 vulnerability CVE-2023-44487
Vendor Advisory
https://www.debian.org/security/2023/dsa-5522

Debian -- Security Information -- DSA-5522-1 tomcat9
Vendor Advisory

CVEs referencing this url
https://istio.io/latest/news/security/istio-security-2023-004/

Istio / ISTIO-SECURITY-2023-004
Vendor Advisory
https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487

HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 | CISA
Third Party Advisory;US Government Resource
https://chaos.social/@icing/111210915918780532

Stefan Eissing: "More details: httpd keeps a „m…" - chaos.social
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/

[SECURITY] Fedora 39 Update: mod_http2-2.0.25-1.fc39 - package-announce - Fedora Mailing-Lists
Mailing List
https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/

HTTP/2 Rapid Reset Attack Impacting NGINX Products - NGINX
Mitigation;Vendor Advisory
https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0

Release nghttp2 v1.57.0 · nghttp2/nghttp2 · GitHub
Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/

[SECURITY] Fedora 37 Update: trafficserver-9.2.3-1.fc37 - package-announce - Fedora Mailing-Lists
Mailing List
https://news.ycombinator.com/item?id=37831062

Google mitigated the largest DDoS attack to date, peaking above 398M rps | Hacker News
Issue Tracking
https://github.com/ninenines/cowboy/issues/1615

Is Cowboy affected by the HTTP/2 Rapid Reset attack? · Issue #1615 · ninenines/cowboy · GitHub
Issue Tracking
https://github.com/microsoft/CBL-Mariner/pull/6381

Fix for nginx and golang for CVE-2023-44487 by ddstreetmicrosoft · Pull Request #6381 · microsoft/CBL-Mariner · GitHub
Issue Tracking;Patch
https://github.com/hyperium/hyper/issues/3337

Pick a default for HTTP/2 server max concurrent streams · Issue #3337 · hyperium/hyper · GitHub
https://www.debian.org/security/2023/dsa-5521

Debian -- Security Information -- DSA-5521-1 tomcat10
Vendor Advisory

CVEs referencing this url
https://bugzilla.suse.com/show_bug.cgi?id=1216123

1216123 – (CVE-2023-44487) VUL-0: CVE-2023-44487: TRACKER-BUG: HTTP/2 Rapid Reset Attack
Issue Tracking;Vendor Advisory
https://github.com/line/armeria/pull/5232

Limit max reset frames to mitigate HTTP/2 RST floods by ikhoon · Pull Request #5232 · line/armeria · GitHub
Issue Tracking;Patch
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/

[SECURITY] Fedora 39 Update: nghttp2-1.55.1-4.fc39 - package-announce - Fedora Mailing-Lists
https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487

HAProxy is not affected by the HTTP/2 Rapid Reset Attack (CVE-2023-44487)
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html

[SECURITY] [DLA 3656-1] netty security update
Mailing List
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487

CVE-2023-44487 - Security Update Guide - Microsoft - MITRE: CVE-2023-44487 HTTP/2 Rapid Reset Attack
Mitigation;Patch;Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/

[SECURITY] Fedora 38 Update: nghttp2-1.52.0-2.fc38 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://github.com/facebook/proxygen/pull/466

Re-sync with internal repository following CVE-2023-44487 by facebook-github-bot · Pull Request #466 · facebook/proxygen · GitHub
Issue Tracking;Patch
https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/

Rapid Reset HTTP/2 Vulnerablilty ⋆ LiteSpeed Blog
Vendor Advisory
https://access.redhat.com/security/cve/cve-2023-44487

CVE-2023-44487- Red Hat Customer Portal
Vendor Advisory
https://github.com/caddyserver/caddy/issues/5877

HTTP/2 Rapid Reset : CVE-2023-44487 · Issue #5877 · caddyserver/caddy · GitHub
Issue Tracking;Vendor Advisory
https://github.com/envoyproxy/envoy/pull/30055

http: Fix CVE CVE-2023-44487 by phlax · Pull Request #30055 · envoyproxy/envoy · GitHub
Issue Tracking;Patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/

[SECURITY] Fedora 37 Update: golang-1.20.10-3.fc37 - package-announce - Fedora Mailing-Lists
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/

[SECURITY] Fedora 39 Update: nodejs20-20.8.1-1.fc39 - package-announce - Fedora Mailing-Lists

CVEs referencing this url
https://github.com/apache/trafficserver/pull/10564

Add an HTTP/2 related rate limiting by maskit · Pull Request #10564 · apache/trafficserver · GitHub
Issue Tracking;Patch
http://www.openwall.com/lists/oss-security/2023/10/18/8

oss-security - Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
Mailing List;Third Party Advisory

CVEs referencing this url
https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause

Rapid Reset (CVE-2023-44487) - DoS in HTTP/2 - Understanding the root cause - vsociety
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/

[SECURITY] Fedora 37 Update: mod_http2-2.0.25-1.fc37 - package-announce - Fedora Mailing-Lists
Mailing List
https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html

Using HTTP/3 Stream Limits in HTTP/2
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/

[SECURITY] Fedora 37 Update: nodejs18-18.18.2-1.fc37 - package-announce - Fedora Mailing-Lists

CVEs referencing this url
https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html

Prague side meeting: HTTP/2 concurrency and request cancellation (CVE-2023-44487) from Mark Nottingham on 2023-10-10 (ietf-http-wg@w3.org from October to December 2023)
Mailing List;Third Party Advisory
https://github.com/advisories/GHSA-vx74-f528-fxqg

github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset · GHSA-vx74-f528-fxqg · GitHub Advisory Database · GitHub
Mitigation;Patch
https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487

PoC/CVE-2023-44487 at main · arkrwn/PoC · GitHub
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/

[SECURITY] Fedora 38 Update: golang-1.20.10-2.fc38 - package-announce - Fedora Mailing-Lists

CVEs referencing this url
https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9

ports - FreeBSD ports tree
Mailing List;Patch;Vendor Advisory
https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/

HTTP/2 'Rapid Reset' zero-day exploited in biggest DDoS yet • The Register
Press/Media Coverage;Third Party Advisory
https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/

How Linkerd became resilient to CVE-2023-44487, a HTTP/2 DDOS vulnerability, six months prior to its disclosure | Linkerd
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/

[SECURITY] Fedora 39 Update: golang-1.21.3-1.fc39 - package-announce - Fedora Mailing-Lists
Mailing List
https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632

initial draft of CVE-2023-44487 blog post by wmorgan · Pull Request #1695 · linkerd/website · GitHub
Patch
https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html

[SECURITY] [DLA 3641-1] jetty9 security update
Mailing List

CVEs referencing this url
https://github.com/tempesta-tech/tempesta/issues/1986

HTTP/2 Rapid Reset DDoS Mitigaton · Issue #1986 · tempesta-tech/tempesta · GitHub
Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/

[SECURITY] Fedora 39 Update: nodejs20-20.8.1-1.fc39 - package-announce - Fedora Mailing-Lists
Mailing List
https://github.com/projectcontour/contour/pull/5826

Set stream limits for HTTP2 protocol - CVE CVE-2023-44487 by akshaysngupta · Pull Request #5826 · projectcontour/contour · GitHub
Issue Tracking;Patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/

[SECURITY] Fedora 39 Update: nghttp2-1.55.1-4.fc39 - package-announce - Fedora Mailing-Lists
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/

[SECURITY] Fedora 39 Update: trafficserver-9.2.3-1.fc39 - package-announce - Fedora Mailing-Lists
Mailing List
https://blog.vespa.ai/cve-2023-44487/

HTTP/2 Rapid Reset (CVE-2023-44487) | Vespa Blog
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/

[SECURITY] Fedora 38 Update: golang-1.20.10-2.fc38 - package-announce - Fedora Mailing-Lists
Mailing List
https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

Google Cloud mitigated largest DDoS attack, peaking above 398 million rps | Google Cloud Blog
Technical Description;Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/10/13/4

oss-security - Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
Mailing List;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/

[SECURITY] Fedora 39 Update: nodejs18-18.18.2-1.fc39 - package-announce - Fedora Mailing-Lists
Mailing List
https://github.com/golang/go/issues/63417

net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-39325) · Issue #63417 · golang/go · GitHub
Issue Tracking
https://github.com/eclipse/jetty.project/issues/10679

Allow HTTP/2 rate control to mitigate HTTP/2 floods (CVE-2023-44487) · Issue #10679 · eclipse/jetty.project · GitHub
Issue Tracking
https://www.openwall.com/lists/oss-security/2023/10/10/6

oss-security - CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
Mailing List;Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html

[SECURITY] [DLA 3617-2] tomcat9 regression update
Mailing List
https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/

HTTP/2 Rapid Reset: deconstructing the record-breaking attack
Technical Description;Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/

[SECURITY] Fedora 37 Update: golang-1.20.10-3.fc37 - package-announce - Fedora Mailing-Lists

CVEs referencing this url
https://github.com/alibaba/tengine/issues/1872

CVE-2023-44487: HTTP/2 Rapid Reset Attack · Issue #1872 · alibaba/tengine · GitHub
Issue Tracking
https://security.netapp.com/advisory/ntap-20240621-0007/

May 2024 IBM Cognos Analytics Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/

HTTP/2 Zero-Day Vulnerability Results in Record-Breaking DDoS Attacks
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/

[SECURITY] Fedora 37 Update: nodejs20-20.8.1-1.fc37 - package-announce - Fedora Mailing-Lists
Mailing List
https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/

Biggest DDoSes of all time generated by protocol 0-day in HTTP/2 | Ars Technica
Press/Media Coverage;Third Party Advisory
https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve

Resets, Leaks, DDoS and the Tale of a Hidden CVE - Edgio
Technical Description;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/

[SECURITY] Fedora 38 Update: nghttp2-1.52.0-2.fc38 - package-announce - Fedora Mailing-Lists
Mailing List
https://github.com/openresty/openresty/issues/930

CVE-2023-44487 issue/fix? · Issue #930 · openresty/openresty · GitHub
Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/

[SECURITY] Fedora 38 Update: trafficserver-9.2.3-1.fc38 - package-announce - Fedora Mailing-Lists
Mailing List

CVEs referencing this url
https://aws.amazon.com/security/security-bulletins/AWS-2023-011/

CVE-2023-44487 - HTTP/2 Rapid Reset Attack
Third Party Advisory
https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244

mod_h2/mod_http2/README.md at 0a864782af0a942aa2ad4ed960a6b32cd35bcf0a · icing/mod_h2 · GitHub
Product
https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088

HTTP/2 Rapid Reset DDoS Attack · GitHub
Patch
https://news.ycombinator.com/item?id=37830987

The novel HTTP/2 'Rapid Reset' DDoS attack | Hacker News
Issue Tracking
https://github.com/micrictor/http2-rst-stream

GitHub - micrictor/http2-rst-stream
Exploit;Third Party Advisory
https://github.com/akka/akka-http/issues/4323

CVE-2023-44487 · Issue #4323 · akka/akka-http · GitHub
Issue Tracking
http://www.openwall.com/lists/oss-security/2023/10/19/6

oss-security - CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST
Mailing List;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/

[SECURITY] Fedora 39 Update: trafficserver-9.2.3-1.fc39 - package-announce - Fedora Mailing-Lists

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html

[SECURITY] [DLA 3621-1] nghttp2 security update
Mailing List

CVEs referencing this url
https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/

New 'HTTP/2 Rapid Reset' zero-day attack breaks DDoS records
Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/13/9

oss-security - Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
Mailing List;Third Party Advisory
https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125

Is Traefik vulnerable to CVE-2023-44487? - Traefik / Traefik v2 (latest) - Traefik Labs Community Forum
Vendor Advisory
https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764

Swift-nio-http2 security update: CVE-2023-44487 HTTP/2 DOS - Related Projects / SwiftNIO - Swift Forums
Vendor Advisory
https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715

HCSEC-2023-32 - Vault, Consul, and Boundary Affected By HTTP/2 “Rapid Reset” Denial of Service Vulnerability (CVE-2023-44487) - Security - HashiCorp Discuss
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2242803

2242803 – (CVE-2023-44487) CVE-2023-44487 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack
Issue Tracking;Vendor Advisory
https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73

core/release-notes/6.0/6.0.23/6.0.23.md at e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec · dotnet/core · GitHub
Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/

[SECURITY] Fedora 39 Update: golang-1.21.3-1.fc39 - package-announce - Fedora Mailing-Lists

CVEs referencing this url
https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html

[PATCH] HTTP/2: per-iteration stream handling limit
Mailing List;Patch;Third Party Advisory
https://github.com/etcd-io/etcd/issues/16740

Resolve CVE-2023-44487 · Issue #16740 · etcd-io/etcd · GitHub
Issue Tracking;Patch
https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html

[SECURITY] [DLA 3638-1] h2o security update
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/

[SECURITY] Fedora 38 Update: nodejs18-18.18.2-1.fc38 - package-announce - Fedora Mailing-Lists

CVEs referencing this url
https://github.com/grpc/grpc-go/pull/6703

server: prohibit more than MaxConcurrentStreams handlers from running at once by dfawley · Pull Request #6703 · grpc/grpc-go · GitHub
Issue Tracking;Patch
https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2

tomcat/java/org/apache/coyote/http2 at main · apache/tomcat · GitHub
Product
https://github.com/kubernetes/kubernetes/pull/121120

Prevent rapid reset http2 DOS on API server by enj · Pull Request #121120 · kubernetes/kubernetes · GitHub
Issue Tracking;Patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/

[SECURITY] Fedora 38 Update: nodejs18-18.18.2-1.fc38 - package-announce - Fedora Mailing-Lists
Mailing List
https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html

[SECURITY] [DLA 3645-1] trafficserver security update
Mailing List

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/

[SECURITY] Fedora 39 Update: nodejs18-18.18.2-1.fc39 - package-announce - Fedora Mailing-Lists

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/

[SECURITY] Fedora 37 Update: nghttp2-1.51.0-2.fc37 - package-announce - Fedora Mailing-Lists
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/

[SECURITY] Fedora 38 Update: nodejs20-20.8.1-1.fc38 - package-announce - Fedora Mailing-Lists
Mailing List
https://github.com/opensearch-project/data-prepper/issues/3474

CVE-2023-44487 (High) detected in multiple libraries · Issue #3474 · opensearch-project/data-prepper · GitHub
Issue Tracking;Patch
https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/

Netlify Successfully Mitigates CVE-2023-44487
Vendor Advisory
https://www.debian.org/security/2023/dsa-5540

Debian -- Security Information -- DSA-5540-1 jetty9
Third Party Advisory

CVEs referencing this url
https://github.com/Kong/kong/discussions/11741

HTTP2 Rapid Reset - CVE-2023-44487 · Kong/kong · Discussion #11741 · GitHub
Issue Tracking
https://github.com/haproxy/haproxy/issues/2312

h2 RST bug aka CVE-2023-44487 · Issue #2312 · haproxy/haproxy · GitHub
Issue Tracking
https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html

[SECURITY] [DLA 3617-1] tomcat9 security update
Mailing List

CVEs referencing this url
https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack

How it works: The novel HTTP/2 ‘Rapid Reset’ DDoS attack | Google Cloud Blog
Technical Description;Vendor Advisory
https://github.com/h2o/h2o/pull/3291

[http2] rapid reset attack by kazuho · Pull Request #3291 · h2o/h2o · GitHub
Issue Tracking;Patch
https://security.gentoo.org/glsa/202311-09

Go: Multiple Vulnerabilities (GLSA 202311-09) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://github.com/nghttp2/nghttp2/pull/1961

Rework session management by tatsuhiro-t · Pull Request #1961 · nghttp2/nghttp2 · GitHub
Issue Tracking;Patch
https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected

hyper HTTP/2 Rapid Reset Attack: Unaffected - seanmonstar
Third Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0006/

February 2024 IBM Cognos Analytics Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20231016-0001/

CVE-2023-44487 HTTP/2 Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/

[SECURITY] Fedora 38 Update: mcrouter-0.41.0.20231016-1.fc38 - package-announce - Fedora Mailing-Lists
Mailing List
https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event

Internet-Wide Zero-Day Bug Fuels Largest-Ever DDoS Event
Press/Media Coverage;Third Party Advisory
https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo

[security] Go 1.21.3 and Go 1.20.10 are released
Mailing List;Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/

[SECURITY] Fedora 38 Update: trafficserver-9.2.3-1.fc38 - package-announce - Fedora Mailing-Lists
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/

[SECURITY] Fedora 37 Update: nghttp2-1.51.0-2.fc37 - package-announce - Fedora Mailing-Lists
Mailing List
https://github.com/apache/httpd-site/pull/10

Document non-impact of CVE-2023-44487 by raboof · Pull Request #10 · apache/httpd-site · GitHub
Issue Tracking
http://www.openwall.com/lists/oss-security/2023/10/20/8

oss-security - Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations
Mailing List
https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113

httpd/modules/http2/h2_mplx.c at afcdbeebbff4b0c50ea26cdd16e178c0d1f24152 · apache/httpd · GitHub
Product
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/

[SECURITY] Fedora 37 Update: folly-2023.10.16.00-1.fc37 - package-announce - Fedora Mailing-Lists
Mailing List
https://github.com/dotnet/announcements/issues/277

Microsoft Security Advisory CVE-2023-44487: .NET Denial of Service Vulnerability · Issue #277 · dotnet/announcements · GitHub
Mitigation;Vendor Advisory
https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/

HTTP/2 Rapid Reset Vulnerability Highlights Need for Rapid Response - Open Source Security Foundation
Third Party Advisory
https://news.ycombinator.com/item?id=37837043

HAProxy is not affected by the HTTP/2 Rapid Reset Attack | Hacker News
Issue Tracking
https://netty.io/news/2023/10/10/4-1-100-Final.html

Netty.news: Netty 4.1.100.Final released
Release Notes;Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/

[SECURITY] Fedora 37 Update: nodejs20-20.8.1-1.fc37 - package-announce - Fedora Mailing-Lists

CVEs referencing this url
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14

Apache Tomcat® - Apache Tomcat 10 vulnerabilities
Release Notes
https://github.com/kazu-yamamoto/http2/issues/93

Does this recent http2 CVE affect this package? · Issue #93 · kazu-yamamoto/http2 · GitHub
Issue Tracking
https://github.com/advisories/GHSA-qppj-fm5r-hxr3

swift-nio-http2 vulnerable to HTTP/2 Stream Cancellation Attack · CVE-2023-44487 · GitHub Advisory Database · GitHub
Vendor Advisory
https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/

Microsoft Response to Distributed Denial of Service (DDoS) Attacks against HTTP/2 | MSRC Blog | Microsoft Security Response Center
Patch;Vendor Advisory
https://github.com/advisories/GHSA-xpw8-rcwv-8f8p

io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack · GHSA-xpw8-rcwv-8f8p · GitHub Advisory Database · GitHub
Patch;Vendor Advisory
https://github.com/bcdannyboy/CVE-2023-44487

GitHub - bcdannyboy/CVE-2023-44487: Basic vulnerability scanning to see if web servers may be vulnerable to CVE-2023-44487
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/

[SECURITY] Fedora 38 Update: nodejs20-20.8.1-1.fc38 - package-announce - Fedora Mailing-Lists

CVEs referencing this url
https://bugzilla.proxmox.com/show_bug.cgi?id=4988

4988 – HTTP/2 Rapid Reset : CVE-2023-44487
Issue Tracking;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/

[SECURITY] Fedora 38 Update: mod_http2-2.0.25-1.fc38 - package-announce - Fedora Mailing-Lists
Mailing List
https://github.com/Azure/AKS/issues/3947

CVE-2023-44487: Distributed Denial of Service (DDoS) Attacks against HTTP/2 · Issue #3947 · Azure/AKS · GitHub
Issue Tracking
https://www.debian.org/security/2023/dsa-5570

Debian -- Security Information -- DSA-5570-1 nghttp2
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/

[SECURITY] Fedora 37 Update: trafficserver-9.2.3-1.fc37 - package-announce - Fedora Mailing-Lists
Mailing List

CVEs referencing this url
https://www.debian.org/security/2023/dsa-5558

Debian -- Security Information -- DSA-5558-1 netty
Third Party Advisory

CVEs referencing this url
https://github.com/junkurihara/rust-rpxy/issues/97

[Announcement] CVE-2023-44487 (HTTP/2 Rapid Reset Attack) does not affect `rpxy` · Issue #97 · junkurihara/rust-rpxy · GitHub
Issue Tracking
https://github.com/oqtane/oqtane.framework/discussions/3367

.NET 7 security vulernability Kestrel Server HTTP/2 · oqtane/oqtane.framework · Discussion #3367 · GitHub
Issue Tracking
https://news.ycombinator.com/item?id=37830998

HTTP/2 Zero-Day Vulnerability Results in Record-Breaking DDoS Attacks | Hacker News
Issue Tracking;Press/Media Coverage
https://github.com/varnishcache/varnish-cache/issues/3996

Handling of CVE-2023-44487 / HTTP2 Rapid Reset · Issue #3996 · varnishcache/varnish-cache · GitHub
Issue Tracking
https://ubuntu.com/security/CVE-2023-44487

CVE-2023-44487 | Ubuntu
Vendor Advisory
https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf

HTTP/2 Rapid Reset · Advisory · h2o/h2o · GitHub
Vendor Advisory
https://security.netapp.com/advisory/ntap-20240426-0007/

CVE-2023-44487 MySQL Cluster Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/

[SECURITY] Fedora 37 Update: nodejs18-18.18.2-1.fc37 - package-announce - Fedora Mailing-Lists
Mailing List
https://github.com/nodejs/node/pull/50121

deps: update nghttp2 to 1.57.0 by jasnell · Pull Request #50121 · nodejs/node · GitHub
Issue Tracking
https://www.debian.org/security/2023/dsa-5549

Debian -- Security Information -- DSA-5549-1 trafficserver
Third Party Advisory

CVEs referencing this url
https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack

CVE-2023-44487 HTTP/2 Rapid Reset Attack | Qualys Security Blog
Press/Media Coverage;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/

[SECURITY] Fedora 39 Update: mvfst-2023.10.16.00-1.fc39 - package-announce - Fedora Mailing-Lists
Mailing List
https://github.com/caddyserver/caddy/releases/tag/v2.7.5

Release v2.7.5 · caddyserver/caddy · GitHub
Release Notes;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/

[SECURITY] Fedora 39 Update: mvfst-2023.10.16.00-1.fc39 - package-announce - Fedora Mailing-Lists
http://www.openwall.com/lists/oss-security/2023/10/18/4

oss-security - Vulnerability in Jenkins
Mailing List;Third Party Advisory

CVEs referencing this url