Actively exploited in the wild
HTTP/2 Rapid Reset Attack Vulnerability
IETF - HTTP/2 · Listed in the CISA KEV since 2023-10-10. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2023-44487
HighCVSS 7.5KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
The HTTP/2 protocol allows a denial of service (server resource consumption) due to the ability to quickly reset many streams through request cancellation. This attack has been exploited in the wild from August to October 2023.
Risk Assessment
Organizations may experience significant availability issues, leading to disruptions in application functionality and potential financial losses.
Recommendation
It is recommended to monitor and limit the number of concurrent HTTP/2 requests and implement mechanisms to protect against denial of service attacks.
Original NVD description (English source)
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.