CVE-2023-44487

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Published: Oct 10, 2023Updated: May 12, 2026 Sources: CVE List NVD GHSA BDU csafNVD-CWE-noinfo

NVD MITRE

7.5CVSSHIGH

Am I actually vulnerable?1 Nuclei template available — see how to check your systems. How to verify

Description

HTTP/2 Stream Cancellation Attack

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:NUser Interaction

None

Scope

S:UScope

Unchanged

Impact

C:NConfidentiality

None

I:NIntegrity

None

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

NVD-CWE-noinfo CWE-400

Affected Products

github.com/apple/swift-nio-http2 SwiftURL

Library

OSS Libraries / generic-library

golang.org/x/net Go OSS Libraries

org.apache.tomcat:tomcat-coyote Maven OSS Libraries

org.apache.tomcat.embed:tomcat-embed-core Maven OSS Libraries

org.eclipse.jetty.http2:http2-common Maven OSS Libraries

swifturl OSS Librariesaka swift-nio-http2, github.com/vapor/vapor, github.com/pytorch/executorch, swift-nio-http2, github.com/apple/swift-nio-http2

gopackage-ecosystemOSS Libraries

mavenpackage-ecosystemOSS Libraries

and 249 more affected products View all →

Attack Graph

Products CVE Techniques Tactics

Click technique nodes to view MITRE ATT&CK details. Scroll to zoom, drag to pan.

Exploitability

CISA Known Exploited Vulnerability

Added to KEV:Oct 10, 2023

Remediation due:Oct 31, 2023

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

2 exploit sources identified

Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.

View exploit details

Official Patch Available

Workaround Available