Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2023-44487

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

VectorNETWORK

PublishedOct 10, 2023, 14:15

Published Bycve@mitre.org

Base Score

Score7.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

github.com/apple/swift-nio-http2(SwiftURL)01.28.0N/A

golang.org/x/net(Go)00.17.0N/A

org.apache.tomcat:tomcat-coyote(Maven)11.0.0-M111.0.0-M12N/A

org.apache.tomcat:tomcat-coyote(Maven)10.0.010.1.14N/A

org.apache.tomcat:tomcat-coyote(Maven)9.0.09.0.81N/A

org.apache.tomcat:tomcat-coyote(Maven)8.5.08.5.94N/A

org.apache.tomcat.embed:tomcat-embed-core(Maven)11.0.0-M111.0.0-M12N/A

org.apache.tomcat.embed:tomcat-embed-core(Maven)10.0.010.1.14N/A

org.apache.tomcat.embed:tomcat-embed-core(Maven)9.0.09.0.81N/A

org.apache.tomcat.embed:tomcat-embed-core(Maven)8.5.08.5.94N/A

org.eclipse.jetty.http2:http2-common(Maven)9.3.09.4.53N/A

org.eclipse.jetty.http2:http2-common(Maven)10.0.010.0.17N/A

org.eclipse.jetty.http2:http2-common(Maven)11.0.011.0.17N/A

org.eclipse.jetty.http2:http2-server(Maven)9.3.09.4.53N/A

org.eclipse.jetty.http2:http2-server(Maven)10.0.010.0.17N/A

org.eclipse.jetty.http2:http2-server(Maven)11.0.011.0.17N/A

org.eclipse.jetty.http2:jetty-http2-common(Maven)12.0.012.0.2N/A

org.eclipse.jetty.http2:jetty-http2-server(Maven)12.0.012.0.2N/A

com.typesafe.akka:akka-http-core(Maven)010.5.3N/A

com.typesafe.akka:akka-http-core_2.13(Maven)010.5.3N/A

com.typesafe.akka:akka-http-core_2.12(Maven)010.5.3N/A

com.typesafe.akka:akka-http-core_2.11(Maven)0N/AN/A

References

Weakness Type

NVD-CWE-noinfo

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK