CVE-2023-44487

Exploited in the wild. In CISA KEV since 2023‑10‑10. Fixed versions are out.

CVSS 3.17.5High EPSS percentile99th100% chance in 30 days CISA KEVListedsince 2023-10-10, due 2023-10-31
Public exploit: 2 sources Fix5 products4 fixed builds listed below

Check it yourself

Nuclei · 1 templateOpenVAS · 405 checks

e.g. HTTP/2 Rapid Reset Attack Detection · OID 1.3.6.1.4.1.25623.1.0.100973

Run the check

Published 2023-10-10Updated 2026-08-11Sources: CVE.org, NVD, GitHub, BDU, CSAF

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

SwiftURL github.com/apple/swift-nio-http2Affected: < 1.28.0Upgrade to: 1.28.0Stated by: GitHub advisory
Golang.org/x/netAffected: < 0.17.0Upgrade to: 0.17.0Stated by: GitHub advisory
Maven org.apache.tomcat:tomcat-coyoteAffected: ≥ 11.0.0-M1, < 11.0.0-M12Upgrade to: 11.0.0-M12Stated by: GitHub advisory
Maven org.apache.tomcat.embed:tomcat-embed-coreAffected: ≥ 11.0.0-M1, < 11.0.0-M12Upgrade to: 11.0.0-M12Stated by: GitHub advisory
Maven org.eclipse.jetty.http2:http2-commonAffected: ≥ 9.3.0, < 9.4.53Upgrade to: 9.4.53Stated by: GitHub advisory

Versions as the sources state them. 144 more products have version data. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run any of these products in your environment: simatic s7-1500 cpu 1518f-4 pn/dp mfp firmware, simatic s7-1500 cpu 1518-4 pn/dp mfp firmware, siplus s7-1500 cpu 1518-4 pn/dp mfp firmware, sinec ins, sinec nms, st7 scadaconnect, ruggedcom ape1808 firmware, http, nghttp2, netty.
For each affected product, upgrade to the fixed version listed by the vendor (see step 4).
If you cannot upgrade immediately, contact your vendor to confirm available mitigations or temporary defenses for “HTTP/2 rapid reset” style attacks.
Apply the known fixed versions: sinec ins → 1.0; sinec nms → 3.0; st7 scadaconnect → 1.1; nghttp2 → 1.57.0; netty → 4.1.100; jetty → 9.4.53; caddy → 2.7.5; go → 1.20.10; http2 → 0.17.0; networking → 0.17.0; nginx plus → r29; swiftnio http/2 → 1.28.0.

Vendor advisory Usually a quick update

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

Coverage timeline

0 publishers

Added to CISA KEV catalog
Oct 10, 2023·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened.

What it is

From the CVE record

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

In plain language

Written by AI from the record

CVE-2023-44487 is an HTTP/2 bug that lets attackers overwhelm servers by rapidly cancelling many connection “streams,” and typical small businesses should treat it as urgent to fix if you run affected HTTP/2 software.

CVE-2023-44487 is a denial-of-service weakness in HTTP/2 implementations that allows an attacker to trigger rapid stream resets via request cancellation, consuming server resources; it requires no authentication and has been exploited in the wild (added to CISA KEV on 2023-10-10).

If you're affected

Service outage for your applications
Web/API performance collapse
Business disruption during attacks
Higher hosting/network costs

What is it

This bug affects software that speaks HTTP/2 (the network protocol many apps use). Attackers can rapidly cancel connection “streams,” forcing the server to do extra work until it slows down or stops. It’s like a customer repeatedly starting and abruptly canceling many phone calls at once—too fast for the system to keep up.

Who is affected

This matters if you run affected HTTP/2 software (for example, nghttp2 or netty) or you operate Siemens SIMATIC S7 / SCADA-connectivity components listed in the finding. Because it does not require authentication or user interaction, an attacker can directly try to reach your network-facing services.

Only consider it a real risk if the vulnerable HTTP/2 functionality is reachable from the internet (or other untrusted networks) and the service is actually using the affected protocol/component in production.

How urgent is it

This is RED because CISA lists CVE-2023-44487 in its Known Exploited Vulnerabilities catalog, and exploitation was confirmed in the wild in August through October 2023. Attackers are actively using it to overwhelm servers by forcing rapid stream resets, which can directly cause service outages.

Act quickly: you should plan and execute upgrades/mitigations immediately for any environment running the affected products or HTTP/2-capable services.

What to do — in detail

Confirm whether you’re exposed

Identify all internet-facing and partner-facing services that use HTTP/2, and check what HTTP/2 stack they run (for example: netty, nghttp2, Jetty, Caddy, Go networking, or HTTP/2 libraries).
Inventory relevant installed components/firmware among the products called out in this finding (including the Siemens SIMATIC S7-1500 firmware and listed industrial networking components).
For each item, determine the exact version currently deployed and whether HTTP/2 is enabled/used in that product configuration.

Upgrade to the fixed versions

Apply the vendor-fixed versions below (upgrade each affected component to at least the listed version):

sinec ins → fixed in 1.0
sinec nms → fixed in 3.0
st7 scadaconnect → fixed in 1.1
nghttp2 → fixed in 1.57.0
netty → fixed in 4.1.100
jetty → fixed in 9.4.53
caddy → fixed in 2.7.5
go → fixed in 1.20.10
http2 → fixed in 0.17.0
networking → fixed in 0.17.0
nginx plus → fixed in r29
swiftnio http/2 → fixed in 1.28.0

Notes / breaking-change considerations

Follow each product vendor’s upgrade notes because HTTP/2 behavior and related networking components can have configuration differences between versions.
For industrial/SCADA-related firmware (Siemens/Ruggedcom components in the finding), confirm upgrade compatibility with your environment and test changes during a maintenance window.

If you can’t patch right away

Contact your vendor for the specific mitigation guidance they provide for CVE-2023-44487 (CISA requires mitigations per vendor instructions when fixes are not immediately available).
Ensure temporary defenses are in place that reduce the impact of HTTP/2 rapid-reset style traffic (for example, vendor-recommended filtering/behavior controls).
Prioritize patching for the most exposed services first (public APIs, web front-ends, gateways, reverse proxies).

Timeline

CISA remediation due date for KEV entry: 2023-10-31.

What to monitor after changes

Monitor for spikes in connection/stream resets, abnormal HTTP/2 error rates, and service instability.
Review availability metrics (latency, error rates, and uptime) during and after any suspected attack windows.

Technical context

CVE-2023-44487 is an HTTP/2 denial-of-service issue focused on server resource consumption. The triggering mechanism is request cancellation resetting many HTTP/2 streams quickly, which can force excessive server work and lead to service degradation or outage.

This is confirmed as exploited in the wild (CISA KEV; added 2023-10-10), with public PoC(s) available. The attack is network-based and does not require authentication or user interaction, increasing its practical exposure for internet-reachable HTTP/2 services. A vendor patch exists across multiple HTTP/2 stacks (including nghttp2 and netty) with fixed versions listed in the patch findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Listed as exploited in the wild since 2023-10-10.

US federal agencies must remediate by 2023-10-31.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

100% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

A public exploit existed 67 days before the patch.

2026-08-16Analysis publishedEPSS vs CVSS vs KEV: which number actually tells you to patch
2026-08-11Patch availableworkaround available, record updated
2026-06-25OpenVAS check added
2026-05-12Patch availableworkaround available, record updated
2026-03-06Public exploit / PoCsource: github-pocnuclei check added
2023-10-10Added to CISA KEVpublished, weakness classified, att&ck mapped

Affected products

Red Hat Inc.commercial · USaka redhat, red hat
cisco
Novell Inc.commercial · US
f5commercial · US
- big-ip access policy managerNetwork DeviceOn-premNetworking Infrastructure / firewall
- big-ip advanced firewall managerSecurity ProductOn-premNetworking Infrastructure / firewall
- big-ip advanced web application firewallSecurity ProductOn-premNetworking Infrastructure / firewall
- big-ip analyticsNetwork DeviceOn-premNetworking Infrastructure / network-management
- big-ip application acceleration managerNetwork DeviceOn-premNetworking Infrastructure / load-balancer-proxy
- big-ip application security managerNetwork DeviceOn-premNetworking Infrastructure / firewall
- big-ip application visibility and reportingNetwork DeviceOn-premNetworking Infrastructure / firewall
- big-ip carrier-grade natNetwork DeviceOn-premNetworking Infrastructure / firewall
Microsoft Corpcommercial · USaka microsoft, microsoft corporation
- Windows 10 1607OSOn-premOperating Systems / windows
- Windows Server 2016 (Server Core installation)OSOn-premOperating Systems / windows
- Windows Server 2019 (Server Core installation)OSOn-premOperating Systems / windows
- Windows Server 2022 (Server Core installation)OSOn-premOperating Systems / windows
- ASP.NET CoreLibraryLibraryOSS Libraries / web-framework
- Microsoft Visual Studio 2022Desktop AppOn-premDevTools & CI / ide-editor
- Windows 11 22H2OSOn-premOperating Systems / windows
- .NETLibraryLibraryOSS Libraries / generic-library
Maven

And 206 more affected products. See all after sign-in

Scale

How widely the affected products are used. This is not a count of vulnerable hosts.

Estimate Public sources, each figure dated. How much of it is already patched is not known.

nginx

Web

30%of websites
Among websites whose web server we know.
W3Techs ↗ · as of 2 Nov 2026 · Medium confidence

Version split · W3Techs · as of 2 Nov 2026

1.2416%
1.2915%
1.1812%
1.3011%
1.2110%
1.316.2%
Other listed29%

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

ImpactT1499Endpoint Denial of Servicehigh confidence

Sources

References in the record

And 540 more references. See all after sign-in

Analysis on the cve.tools blog

EPSS vs CVSS vs KEV: which number actually tells you to patchCVSS is severity, KEV is confirmed exploitation, EPSS is probability. They answer different questions and the moment you equate them you start patching the wrong CVEs. A field guide, plus how the three become a single cut-line in My Stack.2026-08-16 · 3 min read

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next exploited one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Red Hat Enterprise Linux, not every advisory. This one: actively exploited.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account