HTTP/2 Rapid Reset: CVE-2023-44487

A denial-of-service attack on the HTTP/2 protocol that hits nginx, Node.js, Go, Tomcat and many more.

Published in the NVD on 10/10/2023

CVE-2023-44487

CVSS 3.1: 7.5 (high) actively exploited

In the CISA catalogue of actively exploited vulnerabilities since 10/10/2023

Exploitation probability (EPSS, 01/11/2026): 99.999 %, percentile 99.998

What is HTTP/2 Rapid Reset?

HTTP/2 Rapid Reset is a denial-of-service attack on the HTTP/2 protocol itself. A client cancels requests right after it has opened them, so many streams are reset in quick succession and the server uses up its resources. According to the NVD it was exploited in the wild from August to October 2023.

The NVD rates it at CVSS 7.5, and CISA has listed it as actively exploited since 10 October 2023. Because it is a flaw in the protocol, it affects many HTTP/2 implementations. In Debian 12 the nginx package is still marked as not fixed.

Affected and fixed versions

nginx

Affected: 1.9.5 - 1.25.2

No fixed version given in the NVD data

nghttp2

Affected: < 1.57.0

Fixed in 1.57.0

Node.js 20

Affected: 20.0.0 - 20.8.0

Fixed in 20.8.1

Node.js 18

Affected: 18.0.0 - 18.18.1

Fixed in 18.18.2

Go 1.21

Affected: 1.21.0 - 1.21.2

Fixed in 1.21.3

Go

Affected: < 1.20.10

Fixed in 1.20.10

Apache Tomcat 10.1

Affected: 10.1.0 - 10.1.13

No fixed version given in the NVD data

Apache Tomcat 9

Affected: 9.0.0 - 9.0.80

No fixed version given in the NVD data

Netty

Affected: < 4.1.100

Fixed in 4.1.100

All branches and vulnerabilities of nginx

Status in Debian and Ubuntu

Debian 12: nghttp2

Fixed

Fixed from package version 1.52.0-1+deb12u1

Debian 12: nginx

Not fixed

Debian 13: nghttp2

Fixed

Fixed from package version 1.57.0-1

Debian 13: nginx

Fixed

Fixed from package version 1.24.0-2

Ubuntu 20.04 LTS: nghttp2

Fixed

Fixed from package version 1.40.0-1ubuntu0.2

Ubuntu 22.04 LTS: nghttp2

Fixed

Fixed from package version 1.43.0-1ubuntu0.1

Ubuntu 22.04 LTS: tomcat9

Fixed

Fixed from package version 9.0.58-1ubuntu0.2

What to do

Update the HTTP/2 server or library you use to a fixed version from the list, or install the update of your distribution.

Erseni Patch tells you when a new vulnerability affects exactly your version, and when your release branch loses its support. Add the program or package with your version and we check it right away.

Watch nghttp2 (Debian 12)

Already have an account? Log in and add nginx