golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...

Squid security vulnerability

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A security vulnerability exists in Squid versions prior to 6.4, which stems from a buffer overflow that makes it...

The vulnerability of the application programming interface of the Oracle Enterprise Command Center Framework, a system for automating business operations in enterprises, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the application software interface implementation of the Oracle Enterprise Command Center Framework of the Oracle E-Business Suite system for enterprise automation activities is related to insufficient verification of input data. Exploiting this vulnerability can allow an...

golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...

golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...

Oracle Financial Services Applications Security Vulnerability

Oracle Financial Services Applications is a suite of financial services software from Oracle USA. The product includes core banking, online banking and estate management. A security vulnerability exists in Oracle Banking Trade Finance version 14.5-14.7 of Oracle Financial Services Applications,...

Oracle Hospitality Applications Security Vulnerability

Oracle Hospitality Applications is a suite of business applications, servers and storage solutions for hospitality management from Oracle. The product offers features such as managing human resource costs and improving customer satisfaction by providing tracking and management of services...

Oracle Fusion Middleware Security Vulnerability

Oracle Fusion Middleware and Oracle Outside In Technology are both products of Oracle Corporation.Oracle Fusion Middleware is a business innovation platform for enterprise and cloud environments. The platform provides middleware, software collections, and more. Oracle Outside In Technology is a...

Oracle Business Intelligence Enterprise Edition Security Vulnerability

Oracle Business Intelligence Enterprise Edition is an intelligent business analytics software from Oracle. Visualize and analyze enterprise data to support decision-making, reduce total cost of ownership, and increase ROI across the organization. A security vulnerability exists in Oracle Business...

Oracle E-Business Suite Security Vulnerability

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management, and other functions. A security vulnerability exists in Oracle Enterprise...

Oracle E-Business Suite Security Vulnerability

Oracle E-Business Suite E-Business Suite and Oracle Applications Framework are the United States Oracle Oracle products. Oracle E-Business Suite is a fully integrated global business management software. The software provides customer relationship management, service management, financial...

Important: ecs-init

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: ecs-init Note: This advisory is applicable to Amazon...

Oracle E-Business Suite Security Vulnerability

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management, and other functions. A security vulnerability exists in Oracle Enterprise...

Oracle Commerce Security Vulnerability

Oracle Commerce is a suite of e-business solutions from Oracle Corporation. A security vulnerability exists in Oracle Commerce's Oracle Commerce Guided Search version 11.3.2, which originated from a vulnerability that could allow an unauthenticated attacker to compromise Oracle Commerce Guided...

Oracle Fusion Middleware Security Vulnerability

Oracle Fusion Middleware and Oracle HTTP Server are both products of Oracle Corporation.Oracle Fusion Middleware is a business innovation platform for enterprise and cloud environments. The platform provides middleware, software collections, and other capabilities.Oracle HTTP Server is the Web...

Oracle PeopleSoft Enterprise PeopleTools Security Vulnerability

Oracle PeopleSoft Enterprise PeopleTools is Oracle's technology for providing PeopleSoft applications with the ability to stay in sync with users' needs and expectations. A security vulnerability exists in Oracle PeopleSoft's PeopleSoft Enterprise PeopleTools versions 8.59 and 8.60, which...