HTTP/2 Request Stream DoS

🗓️ 11 Oct 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

HTTP/2 creates streams on existing connections without new connections or packet confirmations, enabling remote service failures.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: There is a vulnerability in HTTP/2 protocol used by Netty on IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2023-44487)	5 Apr 202415:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ is vulnerable to issues in Eclipse (CVE-2023-4218, CVE-2023-44487)	29 Feb 202421:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager November 2023 - Multiple CVEs addressed	15 Nov 202313:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server Liberty affect IBM Storage Scale System	16 Sep 202418:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics is affected by multiple vulnerabilities	15 Apr 202503:05	–	ibm
IBM Security Bulletins	Security Bulletin: An Eclipse Jetty vulnerability affects IBM Rational Functional Tester	21 Dec 202317:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect is vulnerable to multiple attacks due to http2-server and http2-common (CVE-2023-44487)	15 Dec 202316:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is vulnerable to denial of service due to HTTP/2 Rapid Reset vulnerability (CVE-2023-44487)	15 Nov 202320:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected by vulnerabilities in multiple Open Source Software (OSS) components	28 Mar 202415:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM protocols are affected by denial of service.	15 Jul 202515:17	–	ibm

Vulners

Node

novell suse_linux_enterprise_high_performance_computingMatch12aurora

novell suse_linux_enterprise_module_for_web_scriptingMatch12aurora

red_hat,openshift_container_platformMatch3.11aurora

red_hat,openshift_container_platformMatch4aurora

novell suse_caas_platformMatch4.0aurora

red_hat,openshift_service_meshMatch2aurora

novell suse_manager_proxyMatch4.2aurora

novell suse_manager_serverMatch4.2aurora

microsoft asp.net_coreMatch6.0aurora

novell suse_linux_enterprise_microMatch5.1aurora

novell suse_manager_retail_branch_serverMatch4.2aurora

novell suse_linux_enterprise_microMatch5.2aurora

red_hat,red_hat_openstack_platformMatch16.2aurora

novell suse_manager_retail_branch_serverMatch4.3aurora

novell suse_manager_proxyMatch4.3aurora

novell suse_manager_serverMatch4.3aurora

microsoft microsoft_visual_studio_2022Match17.2aurora

novell suse_linux_enterprise_microMatch5.3aurora

microsoft .netMatch7.0aurora

microsoft .netMatch6.0aurora

microsoft microsoft_visual_studio_2022Match17.4aurora

red_hat,red_hat_openstack_platformMatch17.0aurora

red_hat,red_hat_openstack_platformMatch16.1aurora

red_hat,red_hat_ceph_storageMatch5aurora

novell suse_package_hubMatch12aurora

novell suse_linux_enterprise_microMatch5.4aurora

microsoft microsoft_visual_studio_2022Match17.6aurora

red_hat,cryostatMatch2aurora

microsoft microsoft_visual_studio_2022Match17.7aurora

red_hat,red_hat_openstack_platformMatch17.1aurora

microsoft asp.net_coreMatch7.0aurora

red_hat,red_hat_ceph_storageMatch6aurora

red_hat,openshift_container_platformMatch16.1aurora

red_hat,openshift_container_platformMatch16.2aurora

red_hat,openshift_container_platformMatch17.0aurora

red_hat,openshift_container_platformMatch17.1aurora

willy_terreau haproxyRange<1.9-devaurora

go goRange<1.21.3aurora

go goRange<1.20.10aurora

google grpcRange<1.59aurora

eclipse jettyRange9.0.0–9.4.53.v20231009aurora

eclipse jettyRange10.0.0–10.0.17aurora

eclipse jettyRange11.0.0–11.0.17aurora

eclipse jettyRange12.0.0–12.0.2aurora

apache nettyRange<4.1.100aurora

apache tomcatRange11.0.0–11.0.0-m12aurora

apache tomcatRange10.0.0–10.1.14aurora

apache tomcatRange9.0.0–9.0.81aurora

apache tomcatRange8.0.0–8.5.94aurora

apache traffic_serverRange<9.2.0aurora

nginx nginx_open_sourceRange1.9.5–1.25.2aurora

nginx nginx_ingress_controllerRange3.0.0–3.3.0aurora

nginx nginx_ingress_controllerRange2.0.0–2.4.2aurora

nginx nginx_ingress_controllerRange1.12.2–1.12.5aurora

novell suse_linux_enterprise_microMatch5.5aurora

axiom_jdk libercat_certifiedRange<9.0.88-2aurora

axiom_jdk libercat_certifiedRange<10.1.20-2aurora

novell opensuse_leapMatch15.5

red_hat,red_hat_enterprise_linuxMatch8

novell suse_linux_enterprise_server_for_sap_applicationsMatch12

novell suse_linux_enterprise_serverMatch12

novell opensuse_leapMatch15.4

red_hat,red_hat_enterprise_linuxMatch9

novell opensuse_leap_microMatch5.3

fedora fedoraMatch38

canonical ubuntuMatch23.04

novell opensuse_leap_microMatch5.4

novell opensuse_leap_microMatch5.5

novell suse_liberty_linuxMatch9

novell suse_liberty_linuxMatch8

novell opensuse_leapMatch15.6

novell suse_linux_microMatch6.0

novell suse_linux_microMatch6.1

Source	Link
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487
ubuntu	www.ubuntu.com/security/notices/USN-6427-1
security-tracker	www.security-tracker.debian.org/tracker/CVE-2023-44487
access	www.access.redhat.com/security/cve/CVE-2023-44487
nginx	www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
mailman	www.mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html
git	www.git.haproxy.org/
github	www.github.com/envoyproxy/envoy/pull/30055
groups	www.groups.google.com/g/golang-announce/c/iNNxDTCjZvo
github	www.github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf

08 Oct 2026 00:00Current

7High risk

Vulners AI Score7

CVSS 37.5

CVSS 27.8

EPSS0.99999