3257 matches found
golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)
A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...
Vulnerability of Fortinet FortiWLM, a centralized management system for WLAN access points and LAN switches, allowing a hacker to execute arbitrary code.
The vulnerability of Fortinet FortiWLM’s WLAN access point and LAN switch management systems exists due to the failure to take measures to neutralize special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a...
PT-2023-6292
Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.58 Description The issue is related to the handling of HTTP/2 streams in the Apache HTTP Server. When a client resets an HTTP/2 stream using an RST frame, there is a time window where the request's memo...
AZL-31310 CVE-2023-39325 affecting package golang for versions less than 1.20.7-2
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...
DEBIAN-CVE-2023-37536
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request...
SUSE CVE-2023-39325
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...
The vulnerability of the HTTP/2 protocol lies in its ability to create request streams within an already established network connection, without the need to establish new connections or confirm the receipt of packets. This allows attackers to cause service failures.
The vulnerability of the HTTP/2 protocol lies in the ability to create request streams within an already established network connection, without the need to establish new network connections or confirm the receipt of packets. Exploiting this vulnerability allows a malicious actor to cause service...
AZL-31292 CVE-2023-44487 affecting package azcopy for versions less than 10.15.0-13
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-35436 CVE-2023-44487 affecting package docker-buildx for versions less than 0.14.0-1
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-31348 CVE-2023-44487 affecting package vitess for versions less than 16.0.2-5
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-34609 CVE-2023-44487 affecting package cmake for versions less than 3.21.4-10
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-34591 CVE-2023-44487 affecting package cf-cli for versions less than 8.4.0-13
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-34827 CVE-2023-44487 affecting package kata-containers-cc for versions less than 0.6.1-2
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-31307 CVE-2023-44487 affecting package flannel for versions less than 0.14.0-18
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-35097 CVE-2023-44487 affecting package packer for versions less than 1.8.1-14
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-31498 CVE-2023-44487 affecting package telegraf for versions less than 1.27.3-3
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-34682 CVE-2023-44487 affecting package etcd for versions less than 3.5.6-11
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
CVE-2023-40534
When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTPREQUEST event or Local Traffic Policy are associated with the virtual server, undisclosed requests can cause TMM to terminate. Note: Software versions which have reached...
Microsoft Response to Distributed Denial of Service (DDoS) Attacks against HTTP/2
Summary Beginning in September 2023, Microsoft was notified by industry partners about a newly identified Distributed Denial-of-Service DDoS attack technique being used in the wild targeting HTTP/2 protocol. This vulnerability CVE-2023-44487 impacts any internet exposed HTTP/2 endpoints. As an...
Apache HTTP/2 资源管理错误漏洞
F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management and other functions. A denial of service vulnerability exists in F5 BIG-IP, which can be exploited by attackers to cause a denial o...