CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 10 Oct 2023, the same day the CVE record was published.
- How likely is exploitation in the next 30 days?
- 100%
EPSS score, percentile 100 of all scored records
- How severe?
- 7.5 High
CVSS v3.1 base score, from CISA's enrichment of the record
- What should I do?
Required action (CISA), due 31 Oct 2023: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Which versions are affected?
Not stated. The CVE record gives vendor and product as “n/a” and the version as “unspecified”.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
What to do
Required action, set by CISA
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date for this action: 31 October 2023.
Advisories and patches
- DSA-5522
- DSA-5521
- FEDORA-2023-ed2642fd58
- FEDORA-2023-54fadada12
- FEDORA-2023-5ff7bf1dd8
- FEDORA-2023-17efd3f2cd
- FEDORA-2023-d5030c983c
- FEDORA-2023-0259c3f26f
- FEDORA-2023-2a9214af5f
- FEDORA-2023-e9c04d81c1
- FEDORA-2023-f66fc0f62a
- FEDORA-2023-4d2fd884ea
Linked from CISA's catalog entry
- https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
- https://nvd.nist.gov/vuln/detail/CVE-2023-44487
Affected products and versions
The CVE record does not name affected products or versions: vendor and product are “n/a” and the version is “unspecified”.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
About this vulnerability
HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).
Summary: CISA's KEV catalog, as of 28 Oct 2026.
- CISA added CVE-2023-44487 to its Known Exploited Vulnerabilities (KEV) catalog on 10 Oct 2023.
- CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
- The due date CISA sets for the required action is 31 Oct 2023.
- The CVE record was published on 10 Oct 2023, the same day it was added to KEV.
- The CVE record carries a CVSS v3.1 base score of 7.5 (High), taken from CISA's enrichment of the record.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 100% (percentile 100), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable yes, technical impact partial.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.
Description
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Weakness
- CWE-400: Uncontrolled Resource Consumption
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| 10 Oct 2023 | CVE record published |
| 10 Oct 2023 | Added to CISA KEV |
| 31 Oct 2023 | CISA due date for the required action |
| 14 Oct 2026 | CVE record last updated |
References
132 more in the CVE record.
More exploited IETF vulnerabilities
- CVE-2023-29552: Service Location Protocol (SLP) Denial-of-Service Vulnerability