CVE-2023-44487
| CVE Published | 2023-10-10 |
|---|---|
| Related CWE(s) | CWE-400: Uncontrolled Resource Consumption |
| Related Vendor(s) | linkerd, projectcontour, f5, ietf, grpc, konghq, apple, eclipse, golang, traefik, varnish_cache_project, kazu-yamamoto, nghttp2, istio, amazon, openresty, jenkins, microsoft, envoyproxy, akka, dena, cisco, fedoraproject, netty, redhat, nodejs, caddyserver, apache, facebook, netapp, linecorp, debian |
| Related Product(s) | decision_manager, go, openshift_pipelines, windows_10_21h2, big-ip_ssl_orchestrator, windows_server_2022, opensearch_data_prepper, web_terminal, self_node_remediation_operator, openshift_dev_spaces, nginx_plus, 3scale_api_management_platform, expressway, azure_kubernetes_service, openshift, cost_management, migration_toolkit_for_containers, istio, apisix, openresty, openshift_virtualization, ceph_storage, big-ip_access_policy_manager, big-ip_next_service_proxy_for_kubernetes, big-ip_domain_name_system, visual_studio_2022, prime_cable_provisioning, big-ip_advanced_firewall_manager, machine_deletion_remediation_operator, secure_web_appliance_firmware, openshift_data_science, run_once_duration_override_operator, big-ip_application_acceleration_manager, nginx_ingress_controller, unified_contact_center_management_portal, jenkins, openshift_developer_tools_and_services, data_center_network_manager, tomcat, openstack_platform, build_of_optaplanner, big-ip_application_security_manager, connected_mobile_experiences, windows_11_21h2, secure_dynamic_attributes_connector, jboss_a-mq_streams, certification_for_red_hat_enterprise_linux, contour, big-ip_next, openshift_secondary_scheduler_operator, integration_camel_k, astra_control_center, armeria, unified_contact_center_enterprise_-_live_data_server, build_of_quarkus, proxygen, nginx, openshift_container_platform, node.js, jboss_data_grid, prime_infrastructure, service_telemetry_framework, firepower_threat_defense, big-ip_carrier-grade_nat, http2, big-ip_global_traffic_manager, advanced_cluster_management_for_kubernetes, windows_11_22h2, windows_server_2016, debian_linux, openshift_sandboxed_containers, openshift_distributed_tracing, advanced_cluster_security, jboss_core_services, ansible_automation_platform, network_observability_operator, cryostat, big-ip_local_traffic_manager, big-ip_analytics, windows_server_2019, networking, nx-os, big-ip_ddos_hybrid_defender, big-ip_policy_enforcement_manager, ultra_cloud_core_-_policy_control_function, http_server, unified_contact_center_enterprise, openshift_container_platform_assisted_installer, process_automation, fedora, big-ip_link_controller, openshift_api_for_data_protection, crosswork_data_gateway, big-ip_advanced_web_application_firewall, traefik, caddy, ios_xe, nghttp2, migration_toolkit_for_virtualization, envoy, logging_subsystem_for_red_hat_openshift, .net, kong_gateway, jboss_enterprise_application_platform, integration_service_registry, node_maintenance_operator, oncommand_insight, windows_10_1607, crosswork_zero_touch_provisioning, http, solr, jetty, windows_10_22h2, ultra_cloud_core_-_session_management_function, cbl-mariner, telepresence_video_communication_server, linkerd, enterprise_chat_and_email, unified_contact_center_domain_manager, support_for_spring_boot, jboss_a-mq, big-ip_websafe, fence_agents_remediation_operator, openshift_service_mesh, grpc, quay, swiftnio_http\/2, node_healthcheck_operator, big-ip_webaccelerator, varnish_cache, traffic_server, enterprise_linux, unified_attendant_console_advanced, windows_10_1809, fog_director, single_sign-on, ios_xr, openshift_serverless, h2o, prime_network_registrar, big-ip_fraud_protection_service, ultra_cloud_core_-_serving_gateway_function, prime_access_registrar, migration_toolkit_for_applications, cert-manager_operator_for_red_hat_openshift, jboss_fuse, secure_malware_analytics, asp.net_core, iot_field_network_director, satellite, service_interconnect, netty, integration_camel_for_spring_boot, big-ip_application_visibility_and_reporting, openshift_gitops |
| Exploitation Reported (CISA KEV) | 2023-10-10 |
| CVSS 3 Base Score | 7.5 (HIGH) |
| CVSS 3 Attack Complexity | LOW |
| CVSS 3 Attack Vector | NETWORK |
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Cyber Threat Graph Context
Explore how this CVE relates to the wider threat graph