VDB
RHEA-2023%3A7327
RHEA-2023%3A7327
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as 'Important' as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit. CVE-2023-39325 was assigned for the `Rapid Reset Attack` in the Go language packages.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | 3scale-amp2/3scale-rhel7-operator-metadata@sha256:352ab243649889842cf0f326cd4fce1868cfa57eb544f553eea8a6cdd6cb4d3e_amd64 as a component of Red Hat 3Scale 2.13 | 3scale-amp2/3scale-rhel7-operator-metadata@sha256:352ab243649889842cf0f326cd4fce1868cfa57eb544f553eea8a6cdd6cb4d3e_amd64, *, 3scale-amp2/3scale-rhel7-operator-metadata@sha256:352ab243649889842cf0f326cd4fce1868cfa57eb544f553eea8a6cdd6cb4d3e_amd64 |
| Red Hat | 3scale-amp2/zync-rhel8@sha256:13b6435c608b33a410e9766729a16f72b266158f5b176640cc8c8b46d5fd8987_amd64 as a component of Red Hat 3Scale 2.13 | 3scale-amp2/zync-rhel8@sha256:13b6435c608b33a410e9766729a16f72b266158f5b176640cc8c8b46d5fd8987_amd64, 3scale-amp2/zync-rhel8@sha256:13b6435c608b33a410e9766729a16f72b266158f5b176640cc8c8b46d5fd8987_amd64, 3scale-amp2/zync-rhel8@sha256:13b6435c608b33a410e9766729a16f72b266158f5b176640cc8c8b46d5fd8987_amd64 |
| Red Hat | 3scale-amp2/apicast-rhel7-operator-metadata@sha256:868ecb3ffa5a83b3eda3f7f4ba31dad0e57e97b857b657a46c8bbdfa69a27922_amd64 as a component of Red Hat 3Scale 2.13 | *, 3scale-amp2/apicast-rhel7-operator-metadata@sha256:868ecb3ffa5a83b3eda3f7f4ba31dad0e57e97b857b657a46c8bbdfa69a27922_amd64, * |
| Red Hat | 3scale-amp2/backend-rhel8@sha256:3f67636d93ed7e1a5fd0ae3a9bc41e0ca4b80180d40638ffc9fc11e682740bfc_s390x as a component of Red Hat 3Scale 2.13 | 3scale-amp2/backend-rhel8@sha256:3f67636d93ed7e1a5fd0ae3a9bc41e0ca4b80180d40638ffc9fc11e682740bfc_s390x, 3scale-amp2/backend-rhel8@sha256:3f67636d93ed7e1a5fd0ae3a9bc41e0ca4b80180d40638ffc9fc11e682740bfc_s390x, 3scale-amp2/backend-rhel8@sha256:3f67636d93ed7e1a5fd0ae3a9bc41e0ca4b80180d40638ffc9fc11e682740bfc_s390x |
| Red Hat | 3scale-amp2/toolbox-rhel8@sha256:480e758bf61a1c77545daa8d078bf1f26ccfd5153723ea6e1159e61e5f11a5d0_s390x as a component of Red Hat 3Scale 2.13 | 3scale-amp2/toolbox-rhel8@sha256:480e758bf61a1c77545daa8d078bf1f26ccfd5153723ea6e1159e61e5f11a5d0_s390x, *, 3scale-amp2/toolbox-rhel8@sha256:480e758bf61a1c77545daa8d078bf1f26ccfd5153723ea6e1159e61e5f11a5d0_s390x |
| Red Hat | 3scale-amp2/memcached-rhel7@sha256:e42b92c87ce020174445ebb0d506dfff90da15c6710a2a1a046a61ad39052b90_amd64 as a component of Red Hat 3Scale 2.13 | *, 3scale-amp2/memcached-rhel7@sha256:e42b92c87ce020174445ebb0d506dfff90da15c6710a2a1a046a61ad39052b90_amd64, 3scale-amp2/memcached-rhel7@sha256:e42b92c87ce020174445ebb0d506dfff90da15c6710a2a1a046a61ad39052b90_amd64 |
| Red Hat | 3scale-amp2/3scale-auth-wasm-rhel8@sha256:6482676ba77f470ff671ac523674e86a609cfa064b59edeba84f5431423fba8d_amd64 as a component of Red Hat 3Scale 2.13 | *, 3scale-amp2/3scale-auth-wasm-rhel8@sha256:6482676ba77f470ff671ac523674e86a609cfa064b59edeba84f5431423fba8d_amd64, 3scale-amp2/3scale-auth-wasm-rhel8@sha256:6482676ba77f470ff671ac523674e86a609cfa064b59edeba84f5431423fba8d_amd64 |
| Red Hat | 3scale-amp2/toolbox-rhel8@sha256:4c3dc23845a2a2a4428e1d3c92f8154d6af74a4cd3b85770c7de41dc6cfe8432_amd64 as a component of Red Hat 3Scale 2.13 | 3scale-amp2/toolbox-rhel8@sha256:4c3dc23845a2a2a4428e1d3c92f8154d6af74a4cd3b85770c7de41dc6cfe8432_amd64, 3scale-amp2/toolbox-rhel8@sha256:4c3dc23845a2a2a4428e1d3c92f8154d6af74a4cd3b85770c7de41dc6cfe8432_amd64, * |
| Red Hat | 3scale-amp2/backend-rhel8@sha256:3f67636d93ed7e1a5fd0ae3a9bc41e0ca4b80180d40638ffc9fc11e682740bfc_s390x as a component of Red Hat 3Scale 2.13 | *, *, * |
| Red Hat | 3scale-amp2/apicast-rhel7-operator@sha256:f6b3e65a3acfdd12f3c091deecd95b86932ad1a0174d303a05fecca54c1cbc70_s390x as a component of Red Hat 3Scale 2.13 | 3scale-amp2/apicast-rhel7-operator@sha256:f6b3e65a3acfdd12f3c091deecd95b86932ad1a0174d303a05fecca54c1cbc70_s390x, 3scale-amp2/apicast-rhel7-operator@sha256:f6b3e65a3acfdd12f3c091deecd95b86932ad1a0174d303a05fecca54c1cbc70_s390x, 3scale-amp2/apicast-rhel7-operator@sha256:f6b3e65a3acfdd12f3c091deecd95b86932ad1a0174d303a05fecca54c1cbc70_s390x |
| Red Hat | 3scale-amp2/apicast-rhel7-operator@sha256:89b3c616730f3d88082e44fd9008c8c58dc85f7e3e55cf6817efc406e37fd861_ppc64le as a component of Red Hat 3Scale 2.13 | *, *, * |
| Red Hat | 3scale-amp2/apicast-gateway-rhel8@sha256:8b98559a9d68b7169664db60c8e492cdf3319771bcffafbd50468e93cfef9cfe_s390x as a component of Red Hat 3Scale 2.13 | 3scale-amp2/apicast-gateway-rhel8@sha256:8b98559a9d68b7169664db60c8e492cdf3319771bcffafbd50468e93cfef9cfe_s390x, *, * |
| Red Hat | 3scale-amp2/backend-rhel8@sha256:081ef7a49e91fd6a88a89e3d5c61f47f59658a3688635dc9680e7182f5af74c5_ppc64le as a component of Red Hat 3Scale 2.13 | 3scale-amp2/backend-rhel8@sha256:081ef7a49e91fd6a88a89e3d5c61f47f59658a3688635dc9680e7182f5af74c5_ppc64le, 3scale-amp2/backend-rhel8@sha256:081ef7a49e91fd6a88a89e3d5c61f47f59658a3688635dc9680e7182f5af74c5_ppc64le, 3scale-amp2/backend-rhel8@sha256:081ef7a49e91fd6a88a89e3d5c61f47f59658a3688635dc9680e7182f5af74c5_ppc64le |
| Red Hat | 3scale-amp2/apicast-rhel7-operator@sha256:4975248f24d7a5bb414729f66d98957cdac23cabefb1b6b8b60bc50d5e4a4ec7_amd64 as a component of Red Hat 3Scale 2.13 | *, 3scale-amp2/apicast-rhel7-operator@sha256:4975248f24d7a5bb414729f66d98957cdac23cabefb1b6b8b60bc50d5e4a4ec7_amd64, * |
| Red Hat | 3scale-amp2/apicast-rhel7-operator-metadata@sha256:cb9e6381aa2b748a0ca7d6a90de784bfded5a57e0446df6b217b9b5112dfa9bc_s390x as a component of Red Hat 3Scale 2.13 | *, *, * |
| Red Hat | 3scale-amp2/memcached-rhel7@sha256:e42b92c87ce020174445ebb0d506dfff90da15c6710a2a1a046a61ad39052b90_amd64 as a component of Red Hat 3Scale 2.13 | *, *, * |
| Red Hat | 3scale-amp2/apicast-rhel7-operator-metadata@sha256:6da016547c24d2c1e044ae8f6639da6a2975792583501d4fd7d9839935941739_ppc64le as a component of Red Hat 3Scale 2.13 | 3scale-amp2/apicast-rhel7-operator-metadata@sha256:6da016547c24d2c1e044ae8f6639da6a2975792583501d4fd7d9839935941739_ppc64le, *, 3scale-amp2/apicast-rhel7-operator-metadata@sha256:6da016547c24d2c1e044ae8f6639da6a2975792583501d4fd7d9839935941739_ppc64le |
| Red Hat | 3scale-amp2/memcached-rhel7@sha256:92320cd96dfb3e5279825f6a019c8c3c6d365252474dc4fe1ec9196d7e9d579f_ppc64le as a component of Red Hat 3Scale 2.13 | *, 3scale-amp2/memcached-rhel7@sha256:92320cd96dfb3e5279825f6a019c8c3c6d365252474dc4fe1ec9196d7e9d579f_ppc64le, * |
| Red Hat | 3scale-amp2/zync-rhel8@sha256:eaa567f706c71f6351d4db8434094d5cf1e89c0c8aa2abee66734bf1225929f4_s390x as a component of Red Hat 3Scale 2.13 | *, *, 3scale-amp2/zync-rhel8@sha256:eaa567f706c71f6351d4db8434094d5cf1e89c0c8aa2abee66734bf1225929f4_s390x |
| Red Hat | 3scale-amp2/apicast-rhel7-operator-metadata@sha256:868ecb3ffa5a83b3eda3f7f4ba31dad0e57e97b857b657a46c8bbdfa69a27922_amd64 as a component of Red Hat 3Scale 2.13 | 3scale-amp2/apicast-rhel7-operator-metadata@sha256:868ecb3ffa5a83b3eda3f7f4ba31dad0e57e97b857b657a46c8bbdfa69a27922_amd64, 3scale-amp2/apicast-rhel7-operator-metadata@sha256:868ecb3ffa5a83b3eda3f7f4ba31dad0e57e97b857b657a46c8bbdfa69a27922_amd64, * |
…and 44 more
Timeline
- Nov 16, 2023 CVE Published
- Apr 26, 2026 Security Advisory
- Apr 28, 2026 Security Advisory
- May 1, 2026 Security Advisory
- Aug 7, 2026 CVE Updated
References
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhea-2023_7327.json advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-44487 advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog exploit
- https://pkg.go.dev/vuln/GO-2023-2102 advisory
- https://access.redhat.com/security/cve/CVE-2023-39325 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-44487 advisory
- https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ advisory
- https://access.redhat.com/errata/RHEA-2023:7327 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2243296 issue
- https://go.dev/issue/63417 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-39325 advisory
- https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487 advisory
- https://github.com/dotnet/announcements/issues/277 advisory
- https://access.redhat.com/security/cve/CVE-2023-44487 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-39325 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2242803 issue
- https://access.redhat.com/security/vulnerabilities/RHSB-2023-003 advisory