CVE-2023-44487 HTTP/2 Rapid Reset: HTTP/2 Rapid Reset Attack
Attackers can cause server resource exhaustion and denial of service by rapidly resetting HTTP/2 streams, affecting various server software implementations.
- Exploited in the wild
- Since 10 Oct 2023
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-44487?
CVE-2023-44487 (HTTP/2 Rapid Reset) is a high-severity denial of service vulnerability in Apache Tomcat, published on 10 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Weakness: CWE-400
Which versions are affected by CVE-2023-44487?
40 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core, apisix and aspnet-core. It affects 165 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.0.0 | 10.1.14 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.0.0 | 10.1.14 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 11.0.0-M1 | 11.0.0-M12 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 11.0.0-M1 | 11.0.0-M12 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.0 | 8.5.94 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.0 | 8.5.94 |
34 more packages
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0 | 9.0.81 |
apisix Bitnami | All versions | 3.6.1 |
aspnet-core Bitnami | From 6.0.0 | 6.0.23, 7.0.12 |
contour Bitnami | All versions | 1.24.6 |
dotnet Bitnami | From 6.0.0 | 6.0.23, 7.0.12 |
dotnet-sdk Bitnami | From 6.0.0 | 6.0.23, 7.0.12 |
envoy Bitnami | All versions | 1.24.12, 1.25.11, 1.26.6, 1.27.2 |
golang Bitnami | All versions | 1.20.10, 1.21.3 |
jenkins Bitnami | All versions | 2.414.3, 2.428.0 |
kong Bitnami | All versions | 3.4.2 |
nginx Bitnami | From 1.9.5 | 1.25.3 |
nginx-gateway Bitnami | From 1.9.5 | 1.25.3 |
node Bitnami | All versions | 18.18.2, 20.8.1 |
node-min Bitnami | All versions | 18.18.2, 20.8.1 |
solr Bitnami | All versions | 9.4.0 |
tomcat Bitnami | From 8.5.0 | 8.5.94, 9.0.81, 10.1.14 |
varnish Bitnami | All versions | 6.0.12, 7.3.1, 7.4.2 |
golang.org/x/net Go | All versions | 0.17.0 |
golang.org/x/net Go | All versions | 0.17.0 |
google.golang.org/grpc Go | All versions | 1.56.3, 1.57.1, 1.58.3 |
google.golang.org/grpc Go | All versions | 1.56.3 |
google.golang.org/grpc Go | All versions | 1.56.3 |
google.golang.org/grpc Go | From 1.57.0 | 1.57.1 |
google.golang.org/grpc Go | From 1.57.0 | 1.57.1 |
google.golang.org/grpc Go | From 1.58.0 | 1.58.3 |
google.golang.org/grpc Go | From 1.58.0 | 1.58.3 |
com.typesafe.akka:akka-http-core Maven | All versions | 10.5.3 |
com.typesafe.akka:akka-http-core Maven | All versions | 10.5.3 |
com.typesafe.akka:akka-http-core_2.11 Maven | All versions to 10.1.15 | None |
com.typesafe.akka:akka-http-core_2.11 Maven | All versions to 10.1.15 | None |
com.typesafe.akka:akka-http-core_2.12 Maven | All versions | 10.5.3 |
com.typesafe.akka:akka-http-core_2.12 Maven | All versions | 10.5.3 |
com.typesafe.akka:akka-http-core_2.13 Maven | All versions | 10.5.3 |
com.typesafe.akka:akka-http-core_2.13 Maven | All versions | 10.5.3 |
Products include Akka Http Server, Amazon Opensearch Data Prepper, Apache Apisix, Apache Solr, Apache Tomcat, Apache Traffic Server and 159 more.
How do I fix CVE-2023-44487?
Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 10.1.14, 11.0.0-M12, 8.5.94 or 9.0.81. US federal agencies must fix it by 31 Oct 2023.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-44487 being exploited?
Yes. Attackers have exploited CVE-2023-44487 in the wild since at least 10 Oct 2023.
Public exploit code: 1 Exploit-DB entry and 26 proofs of concept on GitHub.
Other vulnerabilities in Apache Tomcat
Sources
Also known as ALPINE-CVE-2023-44487, ALSA-2023:5708, ALSA-2023:5709, ALSA-2023:5710, ALSA-2023:5711, ALSA-2023:5712 and 198 more.