CVE-2023-44487

This bug affects software that speaks HTTP/2 (the network protocol many apps use). Attackers can rapidly cancel connection “streams,” forcing the server to do extra work until it slows down or stops. It’s like a customer repeatedly starting and abruptly canceling many phone calls at once—too fast for the system to keep up.

This matters if you run affected HTTP/2 software (for example, nghttp2 or netty) or you operate Siemens SIMATIC S7 / SCADA-connectivity components listed in the finding. Because it does not require authentication or user interaction, an attacker can directly try to reach your network-facing services.

Only consider it a real risk if the vulnerable HTTP/2 functionality is reachable from the internet (or other untrusted networks) and the service is actually using the affected protocol/component in production.

This is RED because CISA lists CVE-2023-44487 in its Known Exploited Vulnerabilities catalog, and exploitation was confirmed in the wild in August through October 2023. Attackers are actively using it to overwhelm servers by forcing rapid stream resets, which can directly cause service outages.

Act quickly: you should plan and execute upgrades/mitigations immediately for any environment running the affected products or HTTP/2-capable services.