CVE-2023-44487
| CVE Published | 2023-10-10 |
|---|---|
| Related CWE(s) | CWE-400: Uncontrolled Resource Consumption |
| Related Vendor(s) | nodejs, traefik, cisco, netty, nghttp2, eclipse, konghq, netapp, debian, projectcontour, linecorp, dena, openresty, apache, grpc, istio, amazon, apple, f5, akka, varnish_cache_project, kazu-yamamoto, jenkins, envoyproxy, redhat, linkerd, fedoraproject, microsoft, caddyserver, ietf, facebook, golang |
| Related Product(s) | integration_camel_for_spring_boot, caddy, traefik, armeria, fog_director, secure_malware_analytics, jboss_a-mq_streams, kong_gateway, windows_10_1809, process_automation, prime_network_registrar, cryostat, big-ip_policy_enforcement_manager, node_maintenance_operator, big-ip_application_security_manager, openresty, openshift_data_science, advanced_cluster_management_for_kubernetes, unified_contact_center_enterprise, go, envoy, node_healthcheck_operator, openshift_service_mesh, integration_camel_k, solr, openshift_developer_tools_and_services, openshift_distributed_tracing, visual_studio_2022, ios_xe, migration_toolkit_for_applications, fedora, integration_service_registry, support_for_spring_boot, linkerd, big-ip_ssl_orchestrator, decision_manager, jboss_fuse, unified_attendant_console_advanced, debian_linux, service_telemetry_framework, ansible_automation_platform, big-ip_fraud_protection_service, openshift_virtualization, big-ip_local_traffic_manager, windows_server_2016, unified_contact_center_enterprise_-_live_data_server, connected_mobile_experiences, quay, node.js, windows_10_22h2, jboss_a-mq, nginx_ingress_controller, proxygen, big-ip_analytics, crosswork_zero_touch_provisioning, nginx_plus, openshift_container_platform, big-ip_application_acceleration_manager, certification_for_red_hat_enterprise_linux, openshift_dev_spaces, cert-manager_operator_for_red_hat_openshift, windows_11_21h2, openshift_serverless, big-ip_websafe, openshift_sandboxed_containers, ultra_cloud_core_-_serving_gateway_function, openshift_secondary_scheduler_operator, migration_toolkit_for_virtualization, ceph_storage, ultra_cloud_core_-_policy_control_function, network_observability_operator, jboss_core_services, jenkins, iot_field_network_director, big-ip_webaccelerator, astra_control_center, openshift_container_platform_assisted_installer, self_node_remediation_operator, windows_server_2019, firepower_threat_defense, openshift, build_of_quarkus, nx-os, netty, cbl-mariner, 3scale_api_management_platform, machine_deletion_remediation_operator, single_sign-on, secure_web_appliance_firmware, windows_10_21h2, big-ip_ddos_hybrid_defender, ultra_cloud_core_-_session_management_function, asp.net_core, h2o, windows_11_22h2, openshift_api_for_data_protection, istio, jboss_enterprise_application_platform, oncommand_insight, big-ip_advanced_firewall_manager, openstack_platform, service_interconnect, cost_management, migration_toolkit_for_containers, secure_dynamic_attributes_connector, contour, prime_access_registrar, advanced_cluster_security, enterprise_linux, tomcat, data_center_network_manager, big-ip_domain_name_system, telepresence_video_communication_server, web_terminal, swiftnio_http\/2, expressway, logging_subsystem_for_red_hat_openshift, satellite, big-ip_application_visibility_and_reporting, big-ip_next_service_proxy_for_kubernetes, http2, windows_10_1607, nghttp2, big-ip_next, http, big-ip_link_controller, azure_kubernetes_service, opensearch_data_prepper, big-ip_access_policy_manager, big-ip_advanced_web_application_firewall, unified_contact_center_domain_manager, crosswork_data_gateway, .net, build_of_optaplanner, windows_server_2022, prime_infrastructure, big-ip_carrier-grade_nat, apisix, big-ip_global_traffic_manager, unified_contact_center_management_portal, grpc, varnish_cache, enterprise_chat_and_email, nginx, ios_xr, jboss_data_grid, fence_agents_remediation_operator, networking, run_once_duration_override_operator, openshift_pipelines, http_server, prime_cable_provisioning, openshift_gitops, traffic_server, jetty |
| Exploitation Reported (CISA KEV) | 2023-10-10 |
| CVSS 3 Base Score | 7.5 (HIGH) |
| CVSS 3 Attack Complexity | LOW |
| CVSS 3 Attack Vector | NETWORK |
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Cyber Threat Graph Context
Explore how this CVE relates to the wider threat graph