Vulnerability identifier: #VU81728

Vulnerability risk: High

CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H/RL:O/RC:C]

CVE-ID: CVE-2023-44487

CWE-ID: CWE-400

Exploitation vector: Network

Exploits in database: 4

• May 23, 2024
  • http2-rst-stream-attacker (Highly configurable tool to check a server's vulnerability against CVE-2023-44487 by rapidly sending HEADERS and RST_STREAM frames and documenting the server's responses.) [Github]
• January 9, 2024
  • CVE-2023-44487 (A python based exploit to test out rapid reset attack (CVE-2023-44487)) [Github]
• October 11, 2023
  • CVE-2023-44487 (Proof of concept for DoS exploit ) [Github]
• October 10, 2023
  • CVE-2023-44487 (Basic vulnerability scanning to see if web servers may be vulnerable to CVE-2023-44487) [Github]

Impact: Denial of service

Vulnerable software:
envoy
Server applications / IDS/IPS systems, Firewalls and proxy servers

Vendor: Cloud Native Computing Foundation