CVE-2023-44487 HTTP
| Affected software | HTTP |
|---|---|
| Severity | 7.5 High CVSS 3.1 2 scores |
| Fixed in | 11.0.0-M12, 10.1.14, 9.0.81, 8.5.94 |
| Weakness | Uncontrolled resource consumption (CWE-400) |
| Published | 10 Oct 2023 |
| Updated | 11 Aug 2026 |
Description
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2023-10-10 · remediation due 2023-10-31 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 23 citations · 25 exploits · earliest 2023-10-10.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: partial.
- Indexed PoC 25 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC; first seen 2023-10-10.
- EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2023-44487 in VulnCheck (free account), which lists 18 more citations and 20 more exploit references not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Reported exploitation | api.msrc.microsoft.com | /cvrf/v3.0/cvrf/2023-Oct | 2023-10-10 |
| Reported exploitation | blog.cloudflare.com | /technical-breakdown-http2-rapid-reset-ddos-attack | 2023-10-10 |
| Reported exploitation | cloud.google.com | /blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack | 2023-10-10 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2023-10-10 |
| Reported exploitation | cve.org | /CVERecord?id=CVE-2023-44487 | 2023-10-10 |
| Exploit reference | VulnCheck XDB 9159bad415be | Exploit type: denial-of-service | 2023-10-07 |
| Exploit reference | VulnCheck XDB 95898a14699a | Exploit type: denial-of-service | 2023-10-10 |
| Exploit reference | VulnCheck XDB 2a1d7187487e | Exploit type: denial-of-service | 2023-10-11 |
| Exploit reference | VulnCheck XDB 6dd9a135b0d8 | Exploit type: denial-of-service | 2023-10-12 |
| Exploit reference | VulnCheck XDB 54af2e2a4404 | Exploit type: denial-of-service | 2023-10-13 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Basic vulnerability scanning to see if web servers may be vulnerable to CVE-2023-44487 | 248 | 2023-10-10 |
| Exploit-DB | HTTP/2 2.0 - Denial Of Service (DOS) | 2025-09-16 | |
| GitHub PoC | Tool for testing mitigations and exposure to Rapid Reset DDoS (CVE-2023-44487) | 76 | 2023-10-13 |
| GitHub PoC | Proof of concept for DoS exploit | 56 | 2023-10-11 |
| GitHub PoC | A python based exploit to test out rapid reset attack (CVE-2023-44487) | 22 | 2023-10-16 |
| GitHub PoC | Examples for Implementing cve-2023-44487 ( HTTP/2 Rapid Reset Attack ) Concept | 15 | 2023-11-10 |
| GitHub PoC | threatlabindonesia/CVE-2023-44487-HTTP-2-Rapid-Reset-Exploit-PoC | 12 | 2024-12-03 |
| GitHub PoC | Highly configurable tool to check a server's vulnerability against CVE-2023-44487 by rapidly sending HEADERS and RST_STREAM frames and documenting the server's responses. | 6 | 2023-11-08 |
| GitHub PoC | poc for the rst dos attack discovered in 2023 | 2 | 2025-12-14 |
| GitHub PoC | HTTP/2 Rapid Reset Exploit PoC | 2 | 2025-04-14 |
Waratek protection
A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.
- Protection none
- Action unverified
- Review automated Inferred
- Record active
| Decided by | A reference pointing at the upstream fix: a commit, a PR, a Red Hat bug |
|---|---|
| Finding | A reference points at an upstream fix (commit tier): https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9. That makes this CVE a candidate for an ARMR patch rule — it is the kind of defect ARMR can address, and there is a fix to work from. No rule exists and none is scheduled: writing one means reading the linked change and finding a hook point ARMR can express it at, which may turn out not to exist. |
| Candidate fix | https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9 : a commit: the change itself |
CVSS
7.5 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
2 metrics
CVSS
7.5 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
NVD | Primary | published |
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CISA-ADP | Secondary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update October 2026 ↗ | CPU | 2026-Q4 | Oracle Communications / Core (Eclipse Jetty) (7.0.0) |
| Oracle Critical Security Patch Update August 2026 ↗ | CSPU | 2026-Q3 | Oracle Fusion Middleware / Imperative Web Server (gRPC) (4.0.0-4.4.1) |
| Oracle Critical Patch Update April 2025 ↗ | CPU | 2025-Q2 | Oracle Analytics / Analytics Server (Nimbus JOSE+JWT) (7.6.0.0.0) Oracle Autonomous Health Framework / Trace File Analyzer (Apache Tomcat) (23.8.0-23.11.0, 24.1.0-24.11.0, 25.1.0, 25.2.0) |
| Oracle Critical Patch Update January 2025 ↗ | CPU | 2025-Q1 | Oracle Analytics / Analytics Server (gRPC) (7.0.0.0.0) |
| Oracle Critical Patch Update October 2024 ↗ | CPU | 2024-Q4 | Oracle Blockchain Platform / Blockchain Cloud Service Console (Netty) (21.1.2) |
| Oracle Critical Patch Update July 2024 ↗ | CPU | 2024-Q3 | Oracle Communications / Management (Nghttp2) (10.4.0.4.3 and prior) Oracle Communications / Routing (Nghttp2) (4.1.0, 4.2.0, 9.2.0, 9.3.0) Oracle Communications Applications / Installation (Nghttp2) (2.0.0.0.0, 2.0.0.1.0) Oracle Supply Chain / Core (Eclipse Jetty) (21.0.2) |
| Oracle Critical Patch Update April 2024 ↗ | CPU | 2024-Q2 | Oracle Communications / Automated Test Suite (Jenkins) (23.3.0) Oracle Communications / Automated Test Suite (Nghttp2) (23.3.0) Oracle Communications / Install/Upgrade (Jenkins) (23.3.0) Oracle Communications / Install/Upgrade (Jenkins) (23.4.1) Oracle Communications / Install/Upgrade (Netty) (23.4.0-23.4.1) Oracle Communications / Install/Upgrade (Netty) (23.4.0-23.4.2) Oracle Communications / Install/Upgrade (Nghttp2) (23.4.0-23.4.1) Oracle Communications / Install/Upgrade (Nghttp2) (23.4.0-23.4.2) Oracle Communications / Install/Upgrade (Nghttp2) (23.4.1) Oracle Communications / Installation (Nghttp2) (23.4.0) Oracle Communications / Observability Services Overlay (Golang Go) (23.4.0) Oracle Communications / Patches (Nghttp2) (9.0.0.0) Oracle Communications / Platform (Eclipse Jetty) (9.0.0.0) Oracle Communications Applications / Cloud Native Deployment (Netty) (12.0.0.4-12.0.0.8, 15.0.0.0) Oracle Enterprise Manager / Job System (Netty) (13.5.0.0) Oracle Financial Services Applications / Accessibility (Eclipse Jetty) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0) Oracle Financial Services Applications / Accessibility (Netty) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0) Oracle Financial Services Applications / Basic Config/Maintenances (Eclipse Jetty) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0) Oracle Financial Services Applications / Basic Config/Maintenances (Netty) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0) Oracle Financial Services Applications / Common (Eclipse Jetty) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0) Oracle Financial Services Applications / Common (Netty) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0) Oracle Financial Services Applications / Common Core (Eclipse Jetty) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0) Oracle Financial Services Applications / Common Core (Netty) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0) Oracle Financial Services Applications / Infrastructure (gRPC) (14.7.0.3.0) Oracle Financial Services Applications / Miscellaneous (Eclipse Jetty) (12.1.0.0.0) Oracle Financial Services Applications / Reports (Eclipse Jetty) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0) Oracle Financial Services Applications / Reports (Netty) (14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0) Oracle Financial Services Applications / Security (Netty) (2.7.0.0.0) Oracle Financial Services Applications / Web UI (Netty) (2.7.0.0.0) Oracle Fusion Middleware / Runtime Java agent for ODI (Eclipse Jetty) (12.2.1.4.0) Oracle Fusion Middleware / Web Container (14.1.1.0.0) Oracle MySQL / Cluster: General (Nghttp2) (8.0.35 and prior, 8.2.0 and prior) Oracle Utilities Applications / Monitoring: High Availability (Netty) (2.5.0.1, 2.5.0.2, 2.6.0.0, 2.6.0.1) |
| Oracle Critical Patch Update January 2024 ↗ | CPU | 2024-Q1 | Oracle Commerce / Workbench (Netty) (11.3.2) Oracle Communications / General (Eclipse Jetty) (23.2.0.0.2, 23.3.0.0.0) Oracle Communications / Install/Upgrade (Eclipse Jetty) (23.2.0, 23.3.1) Oracle Communications / Install/Upgrade (Eclipse Jetty) (23.2.0.0.2, 23.3.0.0.0) Oracle Communications / Install/Upgrade (Eclipse Jetty) (23.3.1) Oracle Communications / Install/Upgrade (Netty) (23.2.0, 23.3.1) Oracle Communications / Install/Upgrade (Netty) (23.3.1) Oracle Communications / Signaling (Eclipse Jetty) (23.3.1) Oracle Communications / Signaling (Netty) (23.3.0) Oracle Communications / Signaling (Netty) (23.3.1) Oracle Communications / Signaling (Nghttp2) (23.3.1) Oracle Communications / Third Party (Netty) (23.2.0.0.2, 23.3.0.0.0) Oracle Communications Applications / Common Functions (Netty) (12.0.6.0.0, 15.0.0.0.0) Oracle Communications Applications / Common Functions (Netty) (12.0.6.0.0, 15.0.0.0.0) Oracle Communications Applications / PSR Designer (Eclipse Jetty) (7.4.0.7.0, 7.4.1.5.0, 7.4.2.8.0) Oracle Communications Applications / PSR Designer (Netty) (7.4.0.7.0, 7.4.1.5.0, 7.4.2.8.0) Oracle Communications Applications / REST Services Manager (Netty) (12.0.0.4.0-12.0.0.8.0, 15.0.0.0.0) Oracle Communications Applications / Security (Netty) (8.1.0.24.0) Oracle Fusion Middleware / Runtime Server (Apache Tomcat) (12.2.1.4.0) Oracle Fusion Middleware / Third Party (Eclipse Jetty) (12.2.1.4.0, 14.1.1.0.0) Oracle Fusion Middleware / Third Party (Netty) (12.2.1.4.0, 14.1.1.0.0) Oracle Java SE / Node (Node.js) (Oracle GraalVM for JDK: 21.0.1) Oracle PeopleSoft / Open Search, Elastic Search (Netty) (8.59, 8.60, 8.61) Oracle Retail Applications / Install (Eclipse Jetty) (20.0.1, 21.0.0-23.0.0) Oracle Siebel CRM / EAI , UI (Apache Tomcat) (Prior to 23.12) Oracle Supply Chain / Security (Apache Tomcat) (9.3.6) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Analytics | Analytics Server (Nimbus JOSE+JWT) | 7.6.0.0.0 | 7.6.0.0.0 |
| Oracle Analytics | Analytics Server (gRPC) | 7.0.0.0.0 | 7.0.0.0.0 |
| Oracle Autonomous Health Framework | Trace File Analyzer (Apache Tomcat) | 23.8.0-23.11.0, 24.1.0-24.11.0, 25.1.0, 25.2.0 | 25.1.0 · 25.2.0 |
| Oracle Blockchain Platform | Blockchain Cloud Service Console (Netty) | 21.1.2 | 21.1.2 |
| Oracle Commerce | Workbench (Netty) | 11.3.2 | 11.3.2 |
| Oracle Communications | Automated Test Suite (Jenkins) | 23.3.0 | 23.3.0 |
| Oracle Communications | Automated Test Suite (Nghttp2) | 23.3.0 | 23.3.0 |
| Oracle Communications | Core (Eclipse Jetty) | 7.0.0 | 7.0.0 |
| Oracle Communications | General (Eclipse Jetty) | 23.2.0.0.2, 23.3.0.0.0 | 23.2.0.0.2 · 23.3.0.0.0 |
| Oracle Communications | Install/Upgrade (Eclipse Jetty) | 23.2.0, 23.3.1 | 23.2.0 · 23.2.0.0.2 · 23.3.0.0.0 · 23.3.1 |
| Oracle Communications | Install/Upgrade (Jenkins) | 23.3.0 | 23.3.0 · 23.4.1 |
| Oracle Communications | Install/Upgrade (Netty) | 23.4.0-23.4.1 | 23.2.0 · 23.3.1 |
| Oracle Communications | Install/Upgrade (Nghttp2) | 23.4.0-23.4.1 | 23.4.1 |
| Oracle Communications | Installation (Nghttp2) | 23.4.0 | 23.4.0 |
| Oracle Communications | Management (Nghttp2) | 10.4.0.4.3 and prior | |
| Oracle Communications | Observability Services Overlay (Golang Go) | 23.4.0 | 23.4.0 |
| Oracle Communications | Patches (Nghttp2) | 9.0.0.0 | 9.0.0.0 |
| Oracle Communications | Platform (Eclipse Jetty) | 9.0.0.0 | 9.0.0.0 |
| Oracle Communications | Routing (Nghttp2) | 4.1.0, 4.2.0, 9.2.0, 9.3.0 | 4.1.0 · 4.2.0 · 9.2.0 · 9.3.0 |
| Oracle Communications | Signaling (Eclipse Jetty) | 23.3.1 | 23.3.1 |
| Oracle Communications | Signaling (Netty) | 23.3.0 | 23.3.0 · 23.3.1 |
| Oracle Communications | Signaling (Nghttp2) | 23.3.1 | 23.3.1 |
| Oracle Communications | Third Party (Netty) | 23.2.0.0.2, 23.3.0.0.0 | 23.2.0.0.2 · 23.3.0.0.0 |
| Oracle Communications Applications | Cloud Native Deployment (Netty) | 12.0.0.4-12.0.0.8, 15.0.0.0 | 15.0.0.0 |
| Oracle Communications Applications | Common Functions (Netty) | 12.0.6.0.0, 15.0.0.0.0 | 12.0.6.0.0 · 15.0.0.0.0 |
| Oracle Communications Applications | Installation (Nghttp2) | 2.0.0.0.0, 2.0.0.1.0 | 2.0.0.0.0 · 2.0.0.1.0 |
| Oracle Communications Applications | PSR Designer (Eclipse Jetty) | 7.4.0.7.0, 7.4.1.5.0, 7.4.2.8.0 | 7.4.0.7.0 · 7.4.1.5.0 · 7.4.2.8.0 |
| Oracle Communications Applications | PSR Designer (Netty) | 7.4.0.7.0, 7.4.1.5.0, 7.4.2.8.0 | 7.4.0.7.0 · 7.4.1.5.0 · 7.4.2.8.0 |
| Oracle Communications Applications | REST Services Manager (Netty) | 12.0.0.4.0-12.0.0.8.0, 15.0.0.0.0 | 15.0.0.0.0 |
| Oracle Communications Applications | Security (Netty) | 8.1.0.24.0 | 8.1.0.24.0 |
| Oracle Enterprise Manager | Job System (Netty) | 13.5.0.0 | 13.5.0.0 |
| Oracle Financial Services Applications | Accessibility (Eclipse Jetty) | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0 |
| Oracle Financial Services Applications | Accessibility (Netty) | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0 |
| Oracle Financial Services Applications | Basic Config/Maintenances (Eclipse Jetty) | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0 |
| Oracle Financial Services Applications | Basic Config/Maintenances (Netty) | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0 |
| Oracle Financial Services Applications | Common (Eclipse Jetty) | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0 |
| Oracle Financial Services Applications | Common (Netty) | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0 |
| Oracle Financial Services Applications | Common Core (Eclipse Jetty) | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0 |
| Oracle Financial Services Applications | Common Core (Netty) | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0 |
| Oracle Financial Services Applications | Infrastructure (gRPC) | 14.7.0.3.0 | 14.7.0.3.0 |
| Oracle Financial Services Applications | Miscellaneous (Eclipse Jetty) | 12.1.0.0.0 | 12.1.0.0.0 |
| Oracle Financial Services Applications | Reports (Eclipse Jetty) | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0 |
| Oracle Financial Services Applications | Reports (Netty) | 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0 | 14.5.0.0.0 · 14.6.0.0.0 · 14.7.0.0.0 |
| Oracle Financial Services Applications | Security (Netty) | 2.7.0.0.0 | 2.7.0.0.0 |
| Oracle Financial Services Applications | Web UI (Netty) | 2.7.0.0.0 | 2.7.0.0.0 |
| Oracle Fusion Middleware | Imperative Web Server (gRPC) | 4.0.0-4.4.1 | |
| Oracle Fusion Middleware | Runtime Java agent for ODI (Eclipse Jetty) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Runtime Server (Apache Tomcat) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Third Party (Eclipse Jetty) | 12.2.1.4.0, 14.1.1.0.0 | 12.2.1.4.0 · 14.1.1.0.0 |
| Oracle Fusion Middleware | Third Party (Netty) | 12.2.1.4.0, 14.1.1.0.0 | 12.2.1.4.0 · 14.1.1.0.0 |
| Oracle Fusion Middleware | Web Container | 14.1.1.0.0 | 14.1.1.0.0 |
| Oracle Java SE | Node (Node.js) | Oracle GraalVM for JDK: 21.0.1 | 21.0.1.0 |
| Oracle MySQL | Cluster: General (Nghttp2) | 8.0.35 and prior, 8.2.0 and prior | |
| Oracle PeopleSoft | Open Search, Elastic Search (Netty) | 8.59, 8.60, 8.61 | 8.59 · 8.60 · 8.61 |
| Oracle Retail Applications | Install (Eclipse Jetty) | 20.0.1, 21.0.0-23.0.0 | 20.0.1 |
| Oracle Siebel CRM | EAI , UI (Apache Tomcat) | Prior to 23.12 | |
| Oracle Supply Chain | Core (Eclipse Jetty) | 21.0.2 | 21.0.2 |
| Oracle Supply Chain | Security (Apache Tomcat) | 9.3.6 | 9.3.6 |
| Oracle Utilities Applications | Monitoring: High Availability (Netty) | 2.5.0.1, 2.5.0.2, 2.6.0.0, 2.6.0.1 | 2.5.0.1 · 2.5.0.2 · 2.6.0.0 · 2.6.0.1 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.tomcat:tomcat-coyote |
11.0.0-M1 | 11.0.0-M12 |
unbounded |
org.apache.tomcat:tomcat-coyote |
10.0.0 | 10.1.14 |
unbounded |
org.apache.tomcat:tomcat-coyote |
9.0.0 | 9.0.81 |
unbounded |
org.apache.tomcat:tomcat-coyote |
8.5.0 | 8.5.94 |
unbounded |
org.apache.tomcat.embed:tomcat-embed-core |
11.0.0-M1 | 11.0.0-M12 |
unbounded |
org.apache.tomcat.embed:tomcat-embed-core |
10.0.0 | 10.1.14 |
unbounded |
org.apache.tomcat.embed:tomcat-embed-core |
9.0.0 | 9.0.81 |
unbounded |
org.apache.tomcat.embed:tomcat-embed-core |
8.5.0 | 8.5.94 |
unbounded |
org.eclipse.jetty.http2:http2-common |
9.3.0 | 9.4.53 |
unbounded |
org.eclipse.jetty.http2:http2-common |
10.0.0 | 10.0.17 |
unbounded |
org.eclipse.jetty.http2:http2-common |
11.0.0 | 11.0.17 |
unbounded |
org.eclipse.jetty.http2:http2-server |
9.3.0 | 9.4.53 |
unbounded |
org.eclipse.jetty.http2:http2-server |
10.0.0 | 10.0.17 |
unbounded |
org.eclipse.jetty.http2:http2-server |
11.0.0 | 11.0.17 |
unbounded |
org.eclipse.jetty.http2:jetty-http2-common |
12.0.0 | 12.0.2 |
unbounded |
org.eclipse.jetty.http2:jetty-http2-server |
12.0.0 | 12.0.2 |
unbounded |
com.typesafe.akka:akka-http-core |
0 | 10.5.3 |
unbounded |
com.typesafe.akka:akka-http-core_2.13 |
0 | 10.5.3 |
unbounded |
com.typesafe.akka:akka-http-core_2.12 |
0 | 10.5.3 |
unbounded |
com.typesafe.akka:akka-http-core_2.11 |
0 | none | 10.1.15 |
Products and versions
175 products, 320 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | akka | http server | generic | ＜ 10.5.3 |
| nvd | amazon | opensearch data prepper | generic | ＜ 2.5.0 |
| nvd | apache | apisix | generic | ＜ 3.6.1 |
| nvd | apache | solr | generic | ＜ 9.4.0 |
| nvd | apache | tomcat | generic | ≥ 8.5.0 and ≤ 8.5.93 · ≥ 9.0.0 and ≤ 9.0.80 · ≥ 10.1.0 and ≤ 10.1.13 · 11.0.0:milestone1 · 11.0.0:milestone10 · 11.0.0:milestone11 · 11.0.0:milestone2 · 11.0.0:milestone3 · 11.0.0:milestone4 · 11.0.0:milestone5 · 11.0.0:milestone6 · 11.0.0:milestone7 · 11.0.0:milestone8 · 11.0.0:milestone9 |
| nvd | apache | traffic server | generic | ≥ 8.0.0 and ＜ 8.1.9 · ≥ 9.0.0 and ＜ 9.2.3 |
| nvd | apple | swiftnio http\/2 | generic | ＜ 1.28.0 |
| nvd | caddyserver | caddy | generic | ＜ 2.7.5 |
| nvd | cisco | business process automation | generic | ＜ 3.2.3.9 |
| nvd | cisco | connected mobile experiences | generic | ＜ 11.1 |
| nvd | cisco | crosswork data gateway | generic | ＜ 4.1.3 · ≥ 5.0.0 and ＜ 5.0.2 |
| nvd | cisco | crosswork situation manager | generic | any version |
| nvd | cisco | crosswork zero touch provisioning | generic | ＜ 6.0.0 |
| nvd | cisco | data center network manager | generic | any version |
| nvd | cisco | enterprise chat and email | generic | any version |
| nvd | cisco | expressway | generic | ＜ 14.3.3 |
| nvd | cisco | fog director | generic | ＜ 1.22 |
| nvd | cisco | ios xe | generic | ＜ 17.15.1 |
| nvd | cisco | ios xr | generic | ＜ 7.11.2 |
| nvd | cisco | iot field network director | generic | ＜ 4.11.0 |
| nvd | cisco | nx-os | generic | ＜ 10.2.7 · ≥ 10.3.1 and ＜ 10.3.5 · ≥ 10.4.1 and ＜ 10.4.2 |
| nvd | cisco | prime access registrar | generic | ＜ 9.3.3 |
| nvd | cisco | prime cable provisioning | generic | ＜ 7.2.1 |
| nvd | cisco | prime infrastructure | generic | ＜ 3.10.4 |
| nvd | cisco | prime network registrar | generic | ＜ 11.2 |
| nvd | cisco | secure dynamic attributes connector | generic | ＜ 2.2.0 |
| nvd | cisco | secure firewall threat defense | generic | ＜ 7.4.2 |
| nvd | cisco | secure malware analytics | generic | ＜ 2.19.2 |
| nvd | cisco | secure web appliance firmware | generic | ＜ 15.1.0 |
| nvd | cisco | telepresence video communication server | generic | ＜ 14.3.3 |
| nvd | cisco | ultra cloud core - policy control function | generic | 2024.01.0 · ＜ 2024.1.0 |
| nvd | cisco | ultra cloud core - serving gateway function | generic | ＜ 2024.2.0 |
| nvd | cisco | ultra cloud core - session management function | generic | ＜ 2024.2.0 |
| nvd | cisco | unified attendant console advanced | generic | any version |
| nvd | cisco | unified contact center domain manager | generic | any version |
| nvd | cisco | unified contact center enterprise | generic | any version |
| nvd | cisco | unified contact center enterprise - live data server | generic | ＜ 12.6.2 |
| nvd | cisco | unified contact center management portal | generic | any version |
| osv | com.typesafe.akka | akka-http-core | generic | ＜ 10.5.3 |
| osv | com.typesafe.akka | akka-http-core_2.11 | generic | ≤ 10.1.15 |
| osv | com.typesafe.akka | akka-http-core_2.12 | generic | ＜ 10.5.3 |
| osv | com.typesafe.akka | akka-http-core_2.13 | generic | ＜ 10.5.3 |
| nvd | debian | debian linux | generic | 10.0 · 11.0 · 12.0 |
| nvd | dena | h2o | generic | ＜ 2023.10.10 |
| nvd | eclipse | jetty | generic | ＜ 9.4.53 · ≥ 10.0.0 and ＜ 10.0.17 · ≥ 11.0.0 and ＜ 11.0.17 · ≥ 12.0.0 and ＜ 12.0.2 |
| nvd | envoyproxy | envoy | generic | 1.24.10 · 1.25.9 · 1.26.4 · 1.27.0 |
| nvd | f5 | big-ip access policy manager | generic | ≥ 13.1.0 and ≤ 13.1.5 · ≥ 14.1.0 and ≤ 14.1.5 · ≥ 15.1.0 and ≤ 15.1.10 · ≥ 16.1.0 and ≤ 16.1.4 · 17.1.0 |
| nvd | f5 | big-ip advanced firewall manager | generic | ≥ 13.1.0 and ≤ 13.1.5 · ≥ 14.1.0 and ≤ 14.1.5 · ≥ 15.1.0 and ≤ 15.1.10 · ≥ 16.1.0 and ≤ 16.1.4 · 17.1.0 |
| nvd | f5 | big-ip advanced web application firewall | generic | ≥ 13.1.0 and ≤ 13.1.5 · ≥ 14.1.0 and ≤ 14.1.5 · ≥ 15.1.0 and ≤ 15.1.10 · ≥ 16.1.0 and ≤ 16.1.4 · 17.1.0 |
| nvd | f5 | big-ip analytics | generic | ≥ 13.1.0 and ≤ 13.1.5 · ≥ 14.1.0 and ≤ 14.1.5 · ≥ 15.1.0 and ≤ 15.1.10 · ≥ 16.1.0 and ≤ 16.1.4 · 17.1.0 |
| nvd | f5 | big-ip application acceleration manager | generic | ≥ 13.1.0 and ≤ 13.1.5 · ≥ 14.1.0 and ≤ 14.1.5 · ≥ 15.1.0 and ≤ 15.1.10 · ≥ 16.1.0 and ≤ 16.1.4 · 17.1.0 |
| nvd | f5 | big-ip application security manager | generic | ≥ 13.1.0 and ≤ 13.1.5 · ≥ 14.1.0 and ≤ 14.1.5 · ≥ 15.1.0 and ≤ 15.1.10 · ≥ 16.1.0 and ≤ 16.1.4 · 17.1.0 |
| nvd | f5 | big-ip application visibility and reporting | generic | ≥ 13.1.0 and ≤ 13.1.5 · ≥ 14.1.0 and ≤ 14.1.5 · ≥ 15.1.0 and ≤ 15.1.10 · ≥ 16.1.0 and ≤ 16.1.4 · 17.1.0 |
| nvd | f5 | big-ip carrier-grade nat | generic | ≥ 13.1.0 and ≤ 13.1.5 · ≥ 14.1.0 and ≤ 14.1.5 · ≥ 15.1.0 and ≤ 15.1.10 · ≥ 16.1.0 and ≤ 16.1.4 · 17.1.0 |
| nvd | f5 | big-ip ddos hybrid defender | generic | ≥ 13.1.0 and ≤ 13.1.5 · ≥ 14.1.0 and ≤ 14.1.5 · ≥ 15.1.0 and ≤ 15.1.10 · ≥ 16.1.0 and ≤ 16.1.4 · 17.1.0 |
| nvd | f5 | big-ip domain name system | generic | ≥ 13.1.0 and ≤ 13.1.5 · ≥ 14.1.0 and ≤ 14.1.5 · ≥ 15.1.0 and ≤ 15.1.10 · ≥ 16.1.0 and ≤ 16.1.4 · 17.1.0 |
| nvd | f5 | big-ip fraud protection service | generic | ≥ 13.1.0 and ≤ 13.1.5 · ≥ 14.1.0 and ≤ 14.1.5 · ≥ 15.1.0 and ≤ 15.1.10 · ≥ 16.1.0 and ≤ 16.1.4 · 17.1.0 |
| nvd | f5 | big-ip global traffic manager | generic | ≥ 13.1.0 and ≤ 13.1.5 · ≥ 14.1.0 and ≤ 14.1.5 · ≥ 15.1.0 and ≤ 15.1.10 · ≥ 16.1.0 and ≤ 16.1.4 · 17.1.0 |
| nvd | f5 | big-ip link controller | generic | ≥ 13.1.0 and ≤ 13.1.5 · ≥ 14.1.0 and ≤ 14.1.5 · ≥ 15.1.0 and ≤ 15.1.10 · ≥ 16.1.0 and ≤ 16.1.4 · 17.1.0 |
| nvd | f5 | big-ip local traffic manager | generic | ≥ 13.1.0 and ≤ 13.1.5 · ≥ 14.1.0 and ≤ 14.1.5 · ≥ 15.1.0 and ≤ 15.1.10 · ≥ 16.1.0 and ≤ 16.1.4 · 17.1.0 |
| nvd | f5 | big-ip next | generic | 20.0.1 |
| nvd | f5 | big-ip next service proxy for kubernetes | generic | ≥ 1.5.0 and ≤ 1.8.2 |
| nvd | f5 | big-ip policy enforcement manager | generic | ≥ 13.1.0 and ≤ 13.1.5 · ≥ 14.1.0 and ≤ 14.1.5 · ≥ 15.1.0 and ≤ 15.1.10 · ≥ 16.1.0 and ≤ 16.1.4 · 17.1.0 |
| nvd | f5 | big-ip ssl orchestrator | generic | ≥ 13.1.0 and ≤ 13.1.5 · ≥ 14.1.0 and ≤ 14.1.5 · ≥ 15.1.0 and ≤ 15.1.10 · ≥ 16.1.0 and ≤ 16.1.4 · 17.1.0 |
| nvd | f5 | big-ip webaccelerator | generic | ≥ 13.1.0 and ≤ 13.1.5 · ≥ 14.1.0 and ≤ 14.1.5 · ≥ 15.1.0 and ≤ 15.1.10 · ≥ 16.1.0 and ≤ 16.1.4 · 17.1.0 |
| nvd | f5 | big-ip websafe | generic | ≥ 13.1.0 and ≤ 13.1.5 · ≥ 14.1.0 and ≤ 14.1.5 · ≥ 15.1.0 and ≤ 15.1.10 · ≥ 16.1.0 and ≤ 16.1.4 · 17.1.0 |
| nvd | f5 | nginx | generic | ≥ 1.9.5 and ≤ 1.25.2 |
| nvd | f5 | nginx ingress controller | generic | ≥ 2.0.0 and ≤ 2.4.2 · ≥ 3.0.0 and ≤ 3.3.0 |
| nvd | f5 | nginx plus | generic | ≥ 25 and ＜ 29 · r29 · r30 |
| nvd | proxygen | generic | ＜ 2023.10.16.0 | |
| nvd | fedoraproject | fedora | generic | 37 · 38 |
| nvd | golang | go | generic | ＜ 1.20.10 · ≥ 1.21.0 and ＜ 1.21.3 |
| nvd | golang | http2 | generic | ＜ 0.17.0 |
| nvd | golang | networking | generic | ＜ 0.17.0 |
| nvd | grpc | grpc | generic | ＜ 1.56.3 · 1.57.0 · ≥ 1.58.0 and ＜ 1.58.3 · ≤ 1.59.2 |
| nvd | ietf | http | generic | 2.0 |
| nvd | istio | istio | generic | ＜ 1.17.6 · ≥ 1.18.0 and ＜ 1.18.3 · ≥ 1.19.0 and ＜ 1.19.1 |
| nvd | jenkins | jenkins | generic | ≤ 2.414.2 · ≤ 2.427 |
| nvd | kazu-yamamoto | http2 | generic | ＜ 4.2.2 |
| nvd | konghq | kong gateway | generic | ＜ 3.4.2 |
| nvd | linecorp | armeria | generic | ＜ 1.26.0 |
| nvd | linkerd | linkerd | generic | ≥ 2.12.0 and ≤ 2.12.5 · 2.13.0 · 2.13.1 · 2.14.0 · 2.14.1 |
| nvd | microsoft | .net | generic | ≥ 6.0.0 and ＜ 6.0.23 · ≥ 7.0.0 and ＜ 7.0.12 |
| nvd | microsoft | asp.net core | generic | ≥ 6.0.0 and ＜ 6.0.23 · ≥ 7.0.0 and ＜ 7.0.12 |
| nvd | microsoft | azure kubernetes service | generic | ＜ 2023.10.8 |
| nvd | microsoft | cbl-mariner | generic | ＜ 2023.10.11 |
| nvd | microsoft | visual studio 2022 | generic | ≥ 17.0 and ＜ 17.2.20 · ≥ 17.4 and ＜ 17.4.12 · ≥ 17.6 and ＜ 17.6.8 · ≥ 17.7 and ＜ 17.7.5 |
| nvd | microsoft | windows 10 1607 | generic | ＜ 10.0.14393.6351 |
| nvd | microsoft | windows 10 1809 | generic | ＜ 10.0.17763.4974 |
| nvd | microsoft | windows 10 21h2 | generic | ＜ 10.0.19044.3570 |
| nvd | microsoft | windows 10 22h2 | generic | ＜ 10.0.19045.3570 |
| nvd | microsoft | windows 11 21h2 | generic | ＜ 10.0.22000.2538 |
| nvd | microsoft | windows 11 22h2 | generic | ＜ 10.0.22621.2428 |
| nvd | microsoft | windows server 2016 | generic | any version |
| nvd | microsoft | windows server 2019 | generic | any version |
| nvd | microsoft | windows server 2022 | generic | any version |
| nvd | netapp | astra control center | generic | any version |
| nvd | netapp | oncommand insight | generic | any version |
| nvd | netty | netty | generic | ＜ 4.1.100 |
| nvd | nghttp2 | nghttp2 | generic | ＜ 1.57.0 |
| nvd | nodejs | node.js | generic | ≥ 18.0.0 and ＜ 18.18.2 · ≥ 20.0.0 and ＜ 20.8.1 |
| nvd | openresty | openresty | generic | ＜ 1.21.4.3 |
| osv | org.apache.tomcat | tomcat-coyote | generic | ≥ 8.5.0 and ＜ 8.5.94 · ≥ 9.0.0 and ＜ 9.0.81 · ≥ 10.0.0 and ＜ 10.1.14 · ≥ 11.0.0 and ＜ 11.0.0 |
| osv | org.apache.tomcat.embed | tomcat-embed-core | generic | ≥ 8.5.0 and ＜ 8.5.94 · ≥ 9.0.0 and ＜ 9.0.81 · ≥ 10.0.0 and ＜ 10.1.14 · ≥ 11.0.0 and ＜ 11.0.0 |
| osv | org.eclipse.jetty.http2 | http2-common | generic | ≥ 9.3.0 and ＜ 9.4.53 · ≥ 10.0.0 and ＜ 10.0.17 · ≥ 11.0.0 and ＜ 11.0.17 |
| osv | org.eclipse.jetty.http2 | http2-server | generic | ≥ 9.3.0 and ＜ 9.4.53 · ≥ 10.0.0 and ＜ 10.0.17 · ≥ 11.0.0 and ＜ 11.0.17 |
| osv | org.eclipse.jetty.http2 | jetty-http2-common | generic | ≥ 12.0.0 and ＜ 12.0.2 |
| osv | org.eclipse.jetty.http2 | jetty-http2-server | generic | ≥ 12.0.0 and ＜ 12.0.2 |
| nvd | projectcontour | contour | generic | ＜ 2023.10.11 |
| nvd | redhat | 3scale api management platform | generic | 2.0 |
| nvd | redhat | advanced cluster management for kubernetes | generic | 2.0 |
| nvd | redhat | advanced cluster security | generic | 3.0 · 4.0 |
| nvd | redhat | ansible automation platform | generic | 2.0 |
| nvd | redhat | build of optaplanner | generic | 8.0 |
| nvd | redhat | build of quarkus | generic | any version |
| nvd | redhat | ceph storage | generic | 5.0 |
| nvd | redhat | cert-manager operator for red hat openshift | generic | any version |
| nvd | redhat | certification for red hat enterprise linux | generic | 8.0 · 9.0 |
| nvd | redhat | cost management | generic | any version |
| nvd | redhat | cryostat | generic | 2.0 |
| nvd | redhat | decision manager | generic | 7.0 |
| nvd | redhat | enterprise linux | generic | 6.0 · 8.0 · 9.0 |
| nvd | redhat | fence agents remediation operator | generic | any version |
| nvd | redhat | integration camel for spring boot | generic | any version |
| nvd | redhat | integration camel k | generic | any version |
| nvd | redhat | integration service registry | generic | any version |
| nvd | redhat | jboss a-mq | generic | 7 |
| nvd | redhat | jboss a-mq streams | generic | any version |
| nvd | redhat | jboss core services | generic | any version |
| nvd | redhat | jboss data grid | generic | 7.0.0 |
| nvd | redhat | jboss enterprise application platform | generic | 6.0.0 · 7.0.0 |
| nvd | redhat | jboss fuse | generic | 6.0.0 · 7.0.0 |
| nvd | redhat | logging subsystem for red hat openshift | generic | any version |
| nvd | redhat | machine deletion remediation operator | generic | any version |
| nvd | redhat | migration toolkit for applications | generic | 6.0 |
| nvd | redhat | migration toolkit for containers | generic | any version |
| nvd | redhat | migration toolkit for virtualization | generic | any version |
| nvd | redhat | network observability operator | generic | any version |
| nvd | redhat | node healthcheck operator | generic | any version |
| nvd | redhat | node maintenance operator | generic | any version |
| nvd | redhat | openshift | generic | any version |
| nvd | redhat | openshift api for data protection | generic | any version |
| nvd | redhat | openshift container platform | generic | 4.0 |
| nvd | redhat | openshift container platform assisted installer | generic | any version |
| nvd | redhat | openshift data science | generic | any version |
| nvd | redhat | openshift dev spaces | generic | any version |
| nvd | redhat | openshift developer tools and services | generic | any version |
| nvd | redhat | openshift distributed tracing | generic | any version |
| nvd | redhat | openshift gitops | generic | any version |
| nvd | redhat | openshift pipelines | generic | any version |
| nvd | redhat | openshift sandboxed containers | generic | any version |
| nvd | redhat | openshift secondary scheduler operator | generic | any version |
| nvd | redhat | openshift serverless | generic | any version |
| nvd | redhat | openshift service mesh | generic | 2.0 |
| nvd | redhat | openshift virtualization | generic | 4 |
| nvd | redhat | openstack platform | generic | 16.1 · 16.2 · 17.1 |
| nvd | redhat | process automation | generic | 7.0 |
| nvd | redhat | quay | generic | 3.0.0 |
| nvd | redhat | run once duration override operator | generic | any version |
| nvd | redhat | satellite | generic | 6.0 |
| nvd | redhat | self node remediation operator | generic | any version |
| nvd | redhat | service interconnect | generic | 1.0 |
| nvd | redhat | service telemetry framework | generic | 1.5 |
| nvd | redhat | single sign-on | generic | 7.0 |
| nvd | redhat | support for spring boot | generic | any version |
| nvd | redhat | web terminal | generic | any version |
| nvd | siemens | ruggedcom ape1808 firmware | generic | any version |
| nvd | siemens | simatic s7-1500 cpu 1518-4 pn\/dp mfp firmware | generic | ≥ 3.1.5 |
| nvd | siemens | simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware | generic | ≥ 3.1.5 |
| nvd | siemens | sinec ins | generic | 1.0 · ＜ 1.0 · 1.0:sp1 · 1.0:sp2 · 1.0:sp2_update_1 · 1.0:sp2_update_2 |
| nvd | siemens | sinec nms | generic | ＜ 3.0 |
| nvd | siemens | siplus s7-1500 cpu 1518-4 pn\/dp mfp firmware | generic | ≥ 3.1.5 |
| nvd | siemens | st7 scadaconnect | generic | ＜ 1.1 |
| nvd | traefik | traefik | generic | ＜ 2.10.5 · 3.0.0:beta1 · 3.0.0:beta2 · 3.0.0:beta3 |
| nvd | varnish cache project | varnish cache | generic | ＜ 2023.10.10 |
References
Timeline
Timeline
| Published | 2023-10-10 | By the CVE Program. |
|---|---|---|
| Added to CISA KEV | 2023-10-10 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| VulnCheck KEV: earliest evidence | 2023-10-10 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| VulnCheck KEV: latest evidence | 2026-08-07 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| NVD record modified | 2026-08-11 | NVD's own last-modified date for this record. |