Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2023-44487GHSA-QPPJ-FM5R-HXR3BIT-APISIX-2023-44487BIT-ASPNET-CORE-2023-44487BIT-CONTOUR-2023-44487BIT-DOTNET-2023-44487BIT-DOTNET-SDK-2023-44487BIT-ENVOY-2023-44487BIT-GOLANG-2023-44487BIT-JENKINS-2023-44487BIT-KONG-2023-44487BIT-NGINX-2023-44487BIT-NGINX-GATEWAY-2023-44487BIT-NODE-2023-44487BIT-NODE-MIN-2023-44487BIT-SOLR-2023-44487BIT-TOMCAT-2023-44487BIT-VARNISH-2023-44487

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

Affects ASP.NET Core Kestrel serving HTTP/2 requests in .NET 6.0, 7.0 and 8.0 RC1. The fix is in 6.0.23 for the 6.0 line and 7.0.12 for the 7.0 line.

Published
Last modified
published
Listed in CISA KEV
Actively exploited
Fix
Fixed in 3.6.1, 6.0.23, 7.0.12, 1.24.6, 1.24.12, and 20 more
1 on Exploit-DB
  • Exploitation: active
  • Automatable: yes
  • Technical impact: partial

Summary

Web servers, proxies, load balancers, and other products that implement the HTTP/2 protocol are affected. A remote attacker can send many rapidly canceled requests, consuming server resources and causing a denial of service.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. CISA SSVC assessment

    Exploitation: active · Automatable: yes · Technical impact: partial

  5. Public exploit on Exploit-DB

    EDB-52426

  6. Record last updated
  7. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • apisixBitnami

    fixed in 3.6.1

  • aspnet-coreBitnami

    From 6.0.0 · fixed in 6.0.23; From 7.0.0 · fixed in 7.0.12

  • contourBitnami

    fixed in 1.24.6

  • dotnetBitnami

    From 6.0.0 · fixed in 6.0.23; From 7.0.0 · fixed in 7.0.12

  • dotnet-sdkBitnami

    From 6.0.0 · fixed in 6.0.23; From 7.0.0 · fixed in 7.0.12

  • envoyBitnami

    fixed in 1.24.12; From 1.25.0 · fixed in 1.25.11; From 1.26.0 · fixed in 1.26.6; From 1.27.0 · fixed in 1.27.2

  • golangBitnami

    fixed in 1.20.10; From 1.21.0-0 · fixed in 1.21.3

  • jenkinsBitnami

    fixed in 2.414.3; From 2.415.0 · fixed in 2.428.0

  • kongBitnami

    fixed in 3.4.2

  • nginxBitnami

    From 1.9.5 · fixed in 1.25.3

  • github.com/apple/swift-nio-http2SwiftURL

    fixed in 1.28.0

  • golang.org/x/netGo

    fixed in 0.17.0

  • org.apache.tomcat:tomcat-coyoteMaven

    From 11.0.0-M1 · fixed in 11.0.0-M12

  • org.apache.tomcat:tomcat-coyoteMaven

    From 10.0.0 · fixed in 10.1.14

  • org.apache.tomcat:tomcat-coyoteMaven

    From 9.0.0 · fixed in 9.0.81

  • org.apache.tomcat:tomcat-coyoteMaven

    From 8.5.0 · fixed in 8.5.94

  • org.apache.tomcat.embed:tomcat-embed-coreMaven

    From 11.0.0-M1 · fixed in 11.0.0-M12

  • org.apache.tomcat.embed:tomcat-embed-coreMaven

    From 10.0.0 · fixed in 10.1.14

  • org.apache.tomcat.embed:tomcat-embed-coreMaven

    From 9.0.0 · fixed in 9.0.81

  • org.apache.tomcat.embed:tomcat-embed-coreMaven

    From 8.5.0 · fixed in 8.5.94

  • org.eclipse.jetty.http2:http2-commonMaven

    From 9.3.0 · fixed in 9.4.53

  • org.eclipse.jetty.http2:http2-commonMaven

    From 10.0.0 · fixed in 10.0.17

  • org.eclipse.jetty.http2:http2-commonMaven

    From 11.0.0 · fixed in 11.0.17

  • org.eclipse.jetty.http2:http2-serverMaven

    From 9.3.0 · fixed in 9.4.53

  • org.eclipse.jetty.http2:http2-serverMaven

    From 10.0.0 · fixed in 10.0.17

  • org.eclipse.jetty.http2:http2-serverMaven

    From 11.0.0 · fixed in 11.0.17

  • org.eclipse.jetty.http2:jetty-http2-commonMaven

    From 12.0.0 · fixed in 12.0.2

  • org.eclipse.jetty.http2:jetty-http2-serverMaven

    From 12.0.0 · fixed in 12.0.2

  • com.typesafe.akka:akka-http-coreMaven

    fixed in 10.5.3

  • com.typesafe.akka:akka-http-core_2.13Maven

    fixed in 10.5.3

  • com.typesafe.akka:akka-http-core_2.12Maven

    fixed in 10.5.3

  • com.typesafe.akka:akka-http-core_2.11Maven

    through 10.1.15

References 26

GitHub · dotnet/core

blog.cloudflare.com

aws.amazon.com

cloud.google.com

nginx.com

news.ycombinator.com

phoronix.com

GitHub · envoyproxy/envoy

GitHub · haproxy/haproxy

GitHub · eclipse/jetty.project

forums.swift.org

GitHub · nghttp2/nghttp2

GitHub · netty/netty

GitHub · alibaba/tengine

GitHub · apache/tomcat

GitHub · caddyserver/caddy

bleepingcomputer.com

GitHub · bcdannyboy/CVE-2023-44487

GitHub · grpc/grpc-go

GitHub · icing/mod_h2

Exploit-DB

FAQ

Questions about CVE-2023-44487

What does this mean?

HTTP/2 lets a client cancel requests and reset streams very quickly. A malicious client can use this to flood the server with specially crafted requests, so the server spends its resources on them and becomes unavailable. This is a denial of service.Source: github.com

Am I affected, and how do I check?

The bug is in ASP.NET Core Kestrel when it handles HTTP/2 requests. The affected ranges are .NET 6.0.0 before 6.0.23 and .NET 7.0.0 before 7.0.12, plus .NET 8.0 RC1. To check an installed version, run dotnet --list-runtimes and compare the version numbers against these ranges.Source: github.com

What should I do about it?

Upgrade to .NET 6.0.23 or later on the 6.0 line, or to 7.0.12 or later on the 7.0 line. The advisory's listed fix version is 6.0.23.Source: github.com

Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-10-10, which means it has evidence of attacks. Public exploit code exists (Exploit-DB).Source: cisa.gov, cve.now feed data