CVE DatabaseCVE-2023-44487

Updated 2026-08-11한국어 권고문 →

CVE-2023-444877.5/HIGHCISA KEVCWE-400

HTTP/2 Protocol Rapid Reset Distributed Denial of Service Vulnerability (CVE-2023-44487)

⚡ Jump to Patch

Affected Vendors

apache, nginx, microsoft, google, cloudflare, haproxy

Affected Components

httpd, nginx, iis, gclb, haproxy

Published Date

2023-10-10

CVSS v3.1

7.5

HIGH

EPSS (30d)

100.0%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

All web servers, reverse proxies, load balancers, and CDN architectures that have the HTTP/2 protocol enabled

Impact

Attackers can cause a complete Denial of Service (DoS) by rapidly opening and immediately canceling (via RST_STREAM) a massive volume of HTTP/2 streams, exhausting server CPU and memory resources

Mitigation

Immediately apply official security patches for your web servers (Nginx, Apache, IIS, etc.) and proxy devices, or restrict HTTP/2 concurrent streams and enforce strict rate limiting

Affected Products & Version Scope

All web servers (Apache HTTPD, Nginx, IIS), reverse proxies (HAProxy, Envoy), load balancers, and cloud CDNs supporting HTTP/2

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Upgrade your web servers and proxy packages to the latest versions containing the official security patches.

bash

# Upgrade Nginx and Apache on Ubuntu/Debian systems
sudo apt-get update
sudo apt-get install --only-upgrade nginx apache2 -y

# Upgrade Nginx and Apache on RHEL/CentOS/Rocky Linux systems
sudo dnf clean all
sudo dnf makecache
sudo dnf upgrade nginx httpd -y

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, temporarily disable HTTP/2 or restrict concurrent streams and connection rates.

nginx

# Nginx Mitigation Configuration (nginx.conf)
# 1. To disable HTTP/2, remove the 'http2' keyword from the listen directive
# listen 443 ssl;

# 2. Harden HTTP/2 stream limits and timeouts
http {
    keepalive_requests 1000;
    http2_max_concurrent_streams 100;
    http2_recv_buffer_size 256k;
    
    # Rate limiting per client IP
    limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;
    limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=100r/s;
    
    server {
        limit_conn conn_limit_per_ip 20;
        limit_req zone=req_limit_per_ip burst=150 nodelay;
    }
}

3. Log Audit & IoC Verification Commands

Use the following commands to inspect web server logs for abnormal request rates or verify HTTP/2 status.

bash

# Analyze Nginx/Apache access logs to identify top IPs by request volume per second
cat /var/log/nginx/access.log | awk '{print $4}' | uniq -c | sort -rn | head -n 20

# Verify if HTTP/2 is enabled on the local server
curl -I --http2 https://localhost/ 2>&1 | grep -i 'HTTP/2'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Immediately apply vendor patches to all HTTP/2-enabled edge servers and configure rate-limiting policies on your WAF/CDN.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2023-44487) is a resource exhaustion denial-of-service (CWE-400) flaw inherent in the design of the HTTP/2 protocol standard. HTTP/2 introduces multiplexing, allowing multiple concurrent, bidirectional streams over a single TCP connection. While clients can cancel active streams by sending a 'RST_STREAM' frame to avoid waiting for server responses, the protocol specification does not prevent clients from abusing this mechanism. The root cause is that the server-side cost of parsing requests and tearing down stream states is significantly higher than the client-side cost of generating and canceling those requests.

2. Exploitation Mechanics & Attack Scenario

An attacker initiates a massive number of HTTP/2 requests (HEADERS frames) over a single TCP connection and immediately follows them with stream cancellation requests (RST_STREAM frames) before the server can process or respond. This technique is known as the 'Rapid Reset' attack. Although HTTP/2 implementations enforce a limit on concurrent active streams (SETTINGS_MAX_CONCURRENT_STREAMS), the rapid cancellation immediately frees up the stream slot, allowing the attacker to bypass this limit and continuously queue new requests. Consequently, the server's CPU spikes to 100% as it continuously processes stream cleanups, leading to memory exhaustion and service unavailability.

3. Infrastructure & Business Impact

Although rated CVSS 7.5 (High), the real-world impact of this vulnerability is catastrophic. It was actively exploited in the wild between August and October 2023 to launch record-breaking DDoS attacks reaching hundreds of millions of requests per second (RPS). Due to its high exploitability and proven impact, it is listed in the CISA KEV catalog and holds an EPSS score of 1.0 (100%). Successful exploitation can completely paralyze enterprise web applications, API gateways, and CDN edge nodes, resulting in severe business disruption, financial loss, and reputational damage.

Official Vendor Advisories & References

NVD Original English Description

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

http://www.openwall.com/lists/oss-security/2023/10/10/6

Source: cve@mitre.org · Mailing List, Third Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/10/7

Source: cve@mitre.org · Mailing List, Third Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/13/4

Source: cve@mitre.org · Mailing List, Third Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/13/9

Source: cve@mitre.org · Mailing List, Third Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/18/4

Source: cve@mitre.org · Mailing List, Third Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/18/8

Source: cve@mitre.org · Mailing List, Third Party Advisory

Frequently Asked SecOps Questions (CVE-2023-44487)

FAQ

Q1. How critical is CVE-2023-44487 and is it actively exploited in the wild?

CVE-2023-44487 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2023-44487?

Primary impacted vendors include apache, nginx, microsoft, google, cloudflare, haproxy across httpd, nginx, iis, gclb, haproxy. Scope summary: All web servers (Apache HTTPD, Nginx, IIS), reverse proxies (HAProxy, Envoy), load balancers, and cloud CDNs supporting HTTP/2

Q3. What temporary mitigations or workarounds exist for CVE-2023-44487 before patching?

[Mitigation] Immediately apply official security patches for your web servers (Nginx, Apache, IIS, etc.) and proxy devices, or restrict HTTP/2 concurrent streams and enforce strict rate limiting Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION