Impact of Rapid Reset and HTTP/2 DoS Vulnerabilities (CVE-2023-44487, CVE-2023-35945)

The Palo Alto Networks Product Security Assurance team is evaluating the recently disclosed denial-of-service (DoS) vulnerabilities in the HTTP/2 protocol including Rapid Reset (CVE-2023-44487) and CVE-2023-35945.

If HTTP/2 inspection is enabled in PAN-OS, an ongoing distributed denial-of-service (DDoS) attack in inspected traffic will contribute towards the session capacity limit of the firewall. This can result in the intermittent availability of new firewall sessions and is consistent in impact with other volumetric DDoS attacks. Availability of new firewall sessions will recover naturally once the DDoS attack stops. Customers who have enabled Threat prevention ID 40152 (Applications and Threats content update 8765) blocks this attack from happening in inspected HTTP/2 traffic.

PAN-OS firewalls that do not perform HTTP/2 inspection are not impacted in any way.
PAN-OS firewalls that do not perform decryption are not impacted by the DDoS attack in encrypted network traffic.
PAN-OS firewall web interface, Captive Portal, GlobalProtect portals, and GlobalProtect gateways are not impacted by these vulnerabilities.

While Prisma Cloud Compute includes vulnerable versions of nghttp2 and golang packages, Prisma Cloud Compute software does not have any HTTP/2 web server endpoints and is not impacted by these vulnerabilities.

Work around:
Customers with a Threat Prevention subscription block attacks for CVE-2023-44487 in their network traffic by enabling Threat ID 40152 (Applications and Threats content update 8765).