4456 matches found
CVE-2023-44487
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
HTTP/2 Rapid Reset Attack Vulnerability
HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack DDoS...
HTTP/2 Stream Cancellation Attack
HTTP/2 Rapid reset attack The HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RSTSTREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The clie...
Fixed in Apache Tomcat 8.5.94
Important: Request smuggling CVE-2023-45648 Tomcat did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. This was fixe...
Fixed in Apache Tomcat 10.1.14
Important: Request smuggling CVE-2023-45648 Tomcat did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. This was fixe...
CVE-2023-44487
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
Apache Tomcat 10.1.0.M1 < 10.1.14 multiple vulnerabilities
The version of Tomcat installed on the remote host is prior to 10.1.14. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat10.1.14security-10 advisory. - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11,...
CVE-2023-44487
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
h2o -- HTTP/2 Rapid Reset attack vulnerability
Kazuo Okuhu reports: H2O is vulnerable to the HTTP/2 Rapid Reset attack. An attacker might be able to consume more than adequate amount of processing power of h2o and the backend servers by mounting the attack...
KB5031356: Windows 10 Version 21H2 / Windows 10 Version 22H2 Security Update (October 2023)
The remote Windows host is missing security update 5031356. It is, therefore, affected by multiple vulnerabilities - The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through...
KB5031354: Windows 11 version 22H2 Security Update (October 2023)
The remote Windows host is missing security update 5031354. It is, therefore, affected by multiple vulnerabilities - The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through...
Fixed in Apache Tomcat 9.0.81
Important: Request smuggling CVE-2023-45648 Tomcat did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. This was fixe...
PT-2023-25586 · Eclipse +6 · Eclipse Jetty +8
Name of the Vulnerable Software and Affected Versions: Eclipse Jetty versions 9.0.0 through 9.4.52 Eclipse Jetty versions 10.0.0 through 10.0.15 Eclipse Jetty versions 11.0.0 through 11.0.15 Description: The issue is caused by an integer overflow in MetaDataBuilder.checkSize, allowing HTTP/2 HPAC...
CVE-2023-44487
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
CVE-2023-44487
CVE-2023-44487 – HTTP/2 Rapid Reset DoS Root cause: HTTP/2 stream resets can cause servers to continue processing, leading to unbounded resource consumption and potential DoS when clients rapidly cancel streams. What’s affected: Various HTTP/2 implementations and deployments, including servers, p...
KB5031358: Windows 11 version 21H2 Security Update (October 2023)
The remote Windows host is missing security update 5031358. It is, therefore, affected by multiple vulnerabilities - The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through...
Apache Tomcat 9.0.0.M1 < 9.0.81 multiple vulnerabilities
The version of Tomcat installed on the remote host is prior to 9.0.81. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.81security-9 advisory. - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, fro...
Apache Tomcat 11.0.0.M1 < 11.0.0.M12 multiple vulnerabilities
The version of Tomcat installed on the remote host is prior to 11.0.0.M12. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat11.0.0-m12security-11 advisory. - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through...
FreeBSD : h2o -- HTTP/2 Rapid Reset attack vulnerability (bf545001-b96d-42e4-9d2e-60fdee204a43)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the bf545001-b96d-42e4-9d2e-60fdee204a43 advisory. - The HTTP/2 protocol allows a denial of service server resource consumption because request cancellati...
