VDB
BIT-node-2023-44487
BIT-node-2023-44487
PUBLISHED
CVSS 7.5 HIGH
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | node | 0, 19.0.0, 0 |
Timeline
- Mar 6, 2024 CVE Published
- May 4, 2026 Distribution Patch
- May 11, 2026 Distribution Patch
- May 11, 2026 Distribution Patch
- May 13, 2026 CVE Updated
- May 15, 2026 Distribution Patch
- May 16, 2026 Distribution Patch
- May 16, 2026 Distribution Patch
References
- https://github.com/caddyserver/caddy/releases/tag/v2.7.5 url
- https://github.com/grpc/grpc-go/pull/6703 url
- https://github.com/line/armeria/pull/5232 url
- https://github.com/micrictor/http2-rst-stream url
- https://github.com/openresty/openresty/issues/930 url
- https://github.com/varnishcache/varnish-cache/issues/3996 url
- https://istio.io/latest/news/security/istio-security-2023-004/ url
- https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/ url
- https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html url
- https://news.ycombinator.com/item?id=37831062 url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/ url
- https://aws.amazon.com/security/security-bulletins/AWS-2023-011/ url
- https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/ url
- http://www.openwall.com/lists/oss-security/2023/10/19/6 url
- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ url
- https://github.com/Azure/AKS/issues/3947 url
- https://github.com/Kong/kong/discussions/11741 url
- https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113 url
- https://github.com/facebook/proxygen/pull/466 url
…and 159 more