CVE-2023-44487
| CVE Published | 2023-10-10 |
|---|---|
| Related CWE(s) | CWE-400: Uncontrolled Resource Consumption |
| Related Vendor(s) | eclipse, akka, linecorp, debian, nghttp2, redhat, netapp, traefik, konghq, golang, istio, amazon, nodejs, linkerd, apache, grpc, projectcontour, f5, ietf, kazu-yamamoto, varnish_cache_project, openresty, facebook, cisco, jenkins, fedoraproject, microsoft, apple, envoyproxy, caddyserver, netty, dena |
| Related Product(s) | ultra_cloud_core_-_session_management_function, .net, cryostat, big-ip_webaccelerator, unified_contact_center_enterprise, openshift, apisix, fog_director, big-ip_websafe, cert-manager_operator_for_red_hat_openshift, big-ip_advanced_web_application_firewall, openshift_gitops, http_server, http2, big-ip_link_controller, node_maintenance_operator, enterprise_linux, decision_manager, service_telemetry_framework, openshift_secondary_scheduler_operator, ios_xe, linkerd, integration_camel_k, openshift_sandboxed_containers, visual_studio_2022, jboss_data_grid, expressway, run_once_duration_override_operator, http, node.js, big-ip_carrier-grade_nat, big-ip_next, prime_cable_provisioning, service_interconnect, big-ip_fraud_protection_service, migration_toolkit_for_applications, prime_access_registrar, traffic_server, iot_field_network_director, build_of_optaplanner, openshift_container_platform_assisted_installer, big-ip_advanced_firewall_manager, big-ip_global_traffic_manager, ceph_storage, openshift_dev_spaces, certification_for_red_hat_enterprise_linux, openshift_service_mesh, openshift_pipelines, contour, windows_10_21h2, traefik, build_of_quarkus, unified_attendant_console_advanced, unified_contact_center_management_portal, nginx_plus, windows_11_21h2, envoy, big-ip_application_security_manager, secure_dynamic_attributes_connector, openshift_container_platform, 3scale_api_management_platform, solr, tomcat, process_automation, migration_toolkit_for_virtualization, jboss_core_services, big-ip_application_visibility_and_reporting, openshift_virtualization, big-ip_ssl_orchestrator, ultra_cloud_core_-_policy_control_function, big-ip_next_service_proxy_for_kubernetes, unified_contact_center_domain_manager, openstack_platform, unified_contact_center_enterprise_-_live_data_server, openshift_distributed_tracing, connected_mobile_experiences, caddy, secure_malware_analytics, kong_gateway, self_node_remediation_operator, windows_10_22h2, windows_server_2022, jetty, crosswork_data_gateway, telepresence_video_communication_server, nx-os, opensearch_data_prepper, openshift_serverless, single_sign-on, prime_infrastructure, jboss_a-mq_streams, swiftnio_http\/2, quay, nginx, cbl-mariner, windows_11_22h2, oncommand_insight, big-ip_analytics, node_healthcheck_operator, armeria, jboss_a-mq, big-ip_access_policy_manager, openshift_data_science, openshift_developer_tools_and_services, migration_toolkit_for_containers, data_center_network_manager, ultra_cloud_core_-_serving_gateway_function, cost_management, astra_control_center, nginx_ingress_controller, advanced_cluster_security, fedora, openresty, azure_kubernetes_service, web_terminal, windows_10_1607, big-ip_policy_enforcement_manager, fence_agents_remediation_operator, big-ip_application_acceleration_manager, proxygen, go, debian_linux, jboss_enterprise_application_platform, machine_deletion_remediation_operator, integration_service_registry, nghttp2, ansible_automation_platform, networking, istio, crosswork_zero_touch_provisioning, asp.net_core, windows_server_2019, jboss_fuse, network_observability_operator, h2o, big-ip_local_traffic_manager, support_for_spring_boot, varnish_cache, grpc, satellite, advanced_cluster_management_for_kubernetes, windows_10_1809, integration_camel_for_spring_boot, firepower_threat_defense, big-ip_domain_name_system, big-ip_ddos_hybrid_defender, openshift_api_for_data_protection, secure_web_appliance_firmware, jenkins, enterprise_chat_and_email, prime_network_registrar, windows_server_2016, netty, ios_xr, logging_subsystem_for_red_hat_openshift |
| Exploitation Reported (CISA KEV) | 2023-10-10 |
| CVSS 3 Base Score | 7.5 (HIGH) |
| CVSS 3 Attack Complexity | LOW |
| CVSS 3 Attack Vector | NETWORK |
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Cyber Threat Graph Context
Explore how this CVE relates to the wider threat graph