Vulnerability identifier: #VU81728

Vulnerability risk: High

CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H/RL:O/RC:C]

CVE-ID: CVE-2023-44487

CWE-ID: CWE-400

Exploitation vector: Network

Exploits in database: 8

• September 27, 2024
  • golang-CVE-2023-44487 () [Github]
• September 20, 2024
  • cve-2023-44487 (Examples for Implementing cve-2023-44487 ( HTTP/2 Rapid Reset Attack ) Concept) [Github]
• September 6, 2024
  • HTTP-2-Rapid-Reset-Client (A tool to check how well a system can handle Rapid Reset DDoS attacks (CVE-2023-44487).) [Github]
• June 28, 2024
  • rapidreset (CVE-2023-44487) [Github]
• May 23, 2024
  • http2-rst-stream-attacker (Highly configurable tool to check a server's vulnerability against CVE-2023-44487 by rapidly sending HEADERS and RST_STREAM frames and documenting the server's responses.) [Github]
• January 9, 2024
  • CVE-2023-44487 (A python based exploit to test out rapid reset attack (CVE-2023-44487)) [Github]
• October 11, 2023
  • CVE-2023-44487 (Proof of concept for DoS exploit ) [Github]
• October 10, 2023
  • CVE-2023-44487 (Basic vulnerability scanning to see if web servers may be vulnerable to CVE-2023-44487) [Github]

Impact: Denial of service

Vulnerable software:
envoy
Server applications / IDS/IPS systems, Firewalls and proxy servers

Vendor: Cloud Native Computing Foundation