VDB
BIT-node-min-2023-44487
BIT-node-min-2023-44487
PUBLISHED
CVSS 7.5 HIGH
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | node-min | 0, 19.0.0, 0 |
Timeline
- Dec 16, 2024 CVE Published
- Apr 30, 2026 Distribution Patch
- May 13, 2026 CVE Updated
- May 15, 2026 Distribution Patch
- May 16, 2026 Distribution Patch
- May 16, 2026 Distribution Patch
- May 16, 2026 Distribution Patch
- May 16, 2026 Distribution Patch
References
- https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/ url
- https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125 url
- https://github.com/apache/trafficserver/pull/10564 url
- https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244 url
- https://github.com/junkurihara/rust-rpxy/issues/97 url
- https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61 url
- https://github.com/openresty/openresty/issues/930 url
- https://github.com/opensearch-project/data-prepper/issues/3474 url
- https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html url
- https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/ url
- https://news.ycombinator.com/item?id=37831062 url
- https://security.gentoo.org/glsa/202311-09 url
- https://security.netapp.com/advisory/ntap-20240426-0007/ url
- https://security.netapp.com/advisory/ntap-20240621-0007/ url
- https://www.debian.org/security/2023/dsa-5558 url
- https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/ url
- http://www.openwall.com/lists/oss-security/2023/10/10/7 url
- https://github.com/grpc/grpc/releases/tag/v1.59.2 url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/ url
…and 159 more