CVE-2023-39325: Allocation of Resources Without Limits or Throttling

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

Patch Tuesday, October 2023 Edition

Microsoft today issued security updates for more than 100 newly-discovered vulnerabilities in its Windows operating system and related software, including four flaws that are already being exploited. In addition, Apple recently released emergency updates to quash a pair of zero-day bugs in iOS...

io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack. Impact This is a DDOS attack, any http2 server is affected and so you should update as soon as possible. Patches This is patched in version...

GHSA-XPW8-RCWV-8F8P io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack. Impact This is a DDOS attack, any http2 server is affected and so you should update as soon as possible. Patches This is patched in version...

[SECURITY] [DSA 5521-1] tomcat10 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5521-1 [email protected] https://www.debian.org/security/ Markus Koschany October 10, 2023 https://www.debian.org/security/faq -...

CVE-2023-44487 HTTP/2 Rapid Reset Attack

Today, Amazon Web Services, Cloudflare, and Google, in a coordinated announcement, reveal their experiences mitigating powerful HTTP/2-based DDoS attacks utilizing a zero-day technique referred to as Rapid Reset, documented under the vulnerability identifier CVE-2023-44487. The attack magnitudes...

cn.taketoday:today-framework (>=4.0.0-draft.1, <=4.0.0-draft.3), com.capgemini.mrchecker:mrchecker-webapi-module (2023.10.10) +116 more potentially affected by CVE-2023-44487 via org.eclipse.jetty.http2:http2-server (>=11.0.0, <=11.0.16)

org.eclipse.jetty.http2:http2-server MAVEN version =11.0.0, =4.0.0-draft.1, =2.2.1, =2.2.1, =2.2.1, =0.20.41, =1.32.0, =3.0.0-beta-2, =2.0.0-b1, =4.0.0, =4.0.3 and more Source cves: CVE-2023-44487 Source advisory: OSV:GHSA-QPPJ-FM5R-HXR3...

app.cash.backfila:client-misk (>=0.1.0, <=0.1.4-20221128.2102-bdd85b6), app.cash.backfila:client-misk-dynamodb (>=0.1.3-20210127.1838-76ab4fc, <=0.1.4-20210806.0204-5341f38) +1186 more potentially affected by CVE-2023-44487 via org.eclipse.jetty.http2:http2-common (>=9.3.0.v20150612, <=9.4.52.v20230823)

org.eclipse.jetty.http2:http2-common MAVEN version =9.3.0.v20150612, =0.1.0, =0.1.3-20210127.1838-76ab4fc, =0.1.3-20210127.1838-76ab4fc, =0.1.3-20210805.0116-93702c4, =0.1.3-20210805.0116-93702c4, =0.1.0, =0.1.0, =0.1.4-20220614.0152-5ae0eef, =0.0.2.alpha, =8.1.0.286, =1.1.6, =1.0.0, =8.10.1.3,...

cn.taketoday:today-framework (>=4.0.0-draft.1, <=4.0.0-draft.3), com.capgemini.mrchecker:mrchecker-webapi-module (2023.10.10) +116 more potentially affected by CVE-2023-44487 via org.eclipse.jetty.http2:http2-server (>=11.0.0, <=11.0.16)

org.eclipse.jetty.http2:http2-server MAVEN version =11.0.0, =4.0.0-draft.1, =2.2.1, =2.2.1, =2.2.1, =0.20.41, =1.32.0, =3.0.0-beta-2, =2.0.0-b1, =4.0.0, =4.0.3 and more Source cves: CVE-2023-44487 Source advisory: GHSA-QPPJ-FM5R-HXR3...

codes.vps:tomcat-valve-request-filter (0.1), com.armanbilge:http4s-tomcat-server_2.12 (>=1.0-148-8da8898, <=1.0-377-020cf9e) +168 more potentially affected by CVE-2023-44487 via org.apache.tomcat:tomcat-coyote (>=9.0.1, <=9.0.80)

org.apache.tomcat:tomcat-coyote MAVEN version =9.0.1, =1.0-148-8da8898, =1.0-148-8da8898, =1.0-148-8da8898, =2.0.0, =2.6.0, =3.2.1036, =1.0.1, =1.3.1, =6.35, =3.1.0, =3.0.0, =3.7.3 and more Source cves: CVE-2023-44487 Source advisory: OSV:GHSA-QPPJ-FM5R-HXR3...

app.cash.backfila:client-misk (>=0.1.4-20221221.1702-8b7db03, <=2024.05.13.200245-a6430b2), app.cash.backfila:client-misk-hibernate (>=0.1.4-20221221.1702-8b7db03, <=2024.05.13.200245-a6430b2) +100 more potentially affected by CVE-2023-44487 via org.eclipse.jetty.http2:http2-server (>=10.0.0, <=10.0.16)

org.eclipse.jetty.http2:http2-server MAVEN version =10.0.0, =0.1.4-20221221.1702-8b7db03, =0.1.4-20221221.1702-8b7db03, =2023.06.07.114626-93b9d6f, =0.1.4-20221221.1702-8b7db03, =0.1.4-20221221.1702-8b7db03, =1.3.6, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.1.0...

HTTP/2 Stream Cancellation Attack

HTTP/2 Rapid reset attack The HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RSTSTREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The clie...

app.cash.backfila:client-misk (>=0.1.0, <=0.1.4-20221128.2102-bdd85b6), app.cash.backfila:client-misk-dynamodb (>=0.1.3-20210127.1838-76ab4fc, <=0.1.4-20210806.0204-5341f38) +1186 more potentially affected by CVE-2023-44487 via org.eclipse.jetty.http2:http2-common (>=9.3.0.v20150612, <=9.4.52.v20230823)

org.eclipse.jetty.http2:http2-common MAVEN version =9.3.0.v20150612, =0.1.0, =0.1.3-20210127.1838-76ab4fc, =0.1.3-20210127.1838-76ab4fc, =0.1.3-20210805.0116-93702c4, =0.1.3-20210805.0116-93702c4, =0.1.0, =0.1.0, =0.1.4-20220614.0152-5ae0eef, =0.0.2.alpha, =8.1.0.286, =1.1.6, =1.0.0, =8.10.1.3,...

HTTP/2 HPACK integer overflow and buffer allocation

An integer overflow in MetaDataBuilder.checkSize allows for HTTP/2 HPACK header values to exceed their size limit. In MetaDataBuilder.java, the following code determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded: java 291 public void...

CVE-2023-44487

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...

Microsoft and Adobe Patch Tuesday, October 2023 Security Update Review

Microsoft released its October edition of Patch Tuesday! In this months updates, Microsoft has addressed 105 vulnerabilities in different products, features, and roles. Lets take a look at the updates in detail. Microsoft Patch Tuesday for October 2023 Microsoft has addressed three zero-day...

github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset

Impact Rapidly creating and cancelling streams HEADERS frame immediately followed by RSTSTREAM without bound cause denial of service. See https://vulners.com/cve/CVE-2023-44487 for details. Patches nghttp2 v1.57.0 mitigates this vulnerability by default. Workarounds If upgrading to nghttp2 v1.57....

GHSA-VX74-F528-FXQG github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset

Impact Rapidly creating and cancelling streams HEADERS frame immediately followed by RSTSTREAM without bound cause denial of service. See https://vulners.com/cve/CVE-2023-44487 for details. Patches nghttp2 v1.57.0 mitigates this vulnerability by default. Workarounds If upgrading to nghttp2 v1.57....

USN-6427-1: .NET vulnerability

It was discovered that the .NET Kestrel web server did not properly handle HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service...

CVE-2023-36478

Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in MetaDataBuilder.checkSize allows for HTTP/2 HPACK header values to exceed their size limit. MetaDataBuilder.java determines if a...