CVE-2023-44487: Multiple Vendors HTTP/2 denial of service via Rapid Reset attack

CVE-2023-44487 · Severity: critical · CVSS 5.3 · Exploited in the wild · Published 2023-10-10

A vulnerability in the HTTP/2 protocol implementation, known as 'Rapid Reset,' allows attackers to overwhelm web servers and proxies with a high volume of requests. By repeatedly opening and immediately canceling requests, an attacker can force the server to perform expensive processing tasks while bypassing standard limits on concurrent connections. This can lead to a denial-of-service (DoS) condition, making websites or applications unavailable to legitimate users.

Technologies: Apache HTTP Server, Apache Tomcat, Apache Tomcat-Embed-Core, Apple SwiftNIO HTTP2, Eclipse Foundation Jetty, Envoy Proxy Envoy, golang.org/x/net (Go), com.typesafe.akka:akka-http-core_2.11 (Maven), com.typesafe.akka:akka-http-core_2.12 (Maven), org.apache.tomcat:tomcat-coyote (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven), org.eclipse.jetty.http2:http2-common (Maven), org.eclipse.jetty.http2:jetty-http2-common (Maven). Vendors: Apache, Apple, Eclipse, Eclipse Foundation, Envoy Proxy, F5, Go, Maven, Swift.

Quick answers

Is CVE-2023-44487 exploited in the wild?
Yes. CVE-2023-44487 is known to be exploited in the wild, first recorded on 10 October 2023. Treat it as urgent.
How severe is CVE-2023-44487?
Critical severity, with a CVSS score of 5.3, published 10 October 2023.
Which products and versions are affected?
golang.org/x/net (Go) SEMVER:introduced=0,fixed=0.17.0; com.typesafe.akka:akka-http-core (Maven) ECOSYSTEM:introduced=0,fixed=10.5.3; com.typesafe.akka:akka-http-core_2.11 (Maven) ECOSYSTEM:introduced=0,last_affected=10.1.15; com.typesafe.akka:akka-http-core_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=10.5.3; and 8 more.
Is there a fix for CVE-2023-44487?
Yes. golang.org/x/net (Go): upgrade to 0.17.0 or later; com.typesafe.akka:akka-http-core (Maven): upgrade to 10.5.3 or later; com.typesafe.akka:akka-http-core_2.12 (Maven): upgrade to 10.5.3 or later; com.typesafe.akka:akka-http-core_2.13 (Maven): upgrade to 10.5.3 or later; org.apache.tomcat:tomcat-coyote (Maven): upgrade to 11.0.0-M12 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 11.0.0-M12 or later; org.eclipse.jetty.http2:http2-common (Maven): upgrade to 9.4.53 or later; org.eclipse.jetty.http2:http2-server (Maven): upgrade to 9.4.53 or later; org.eclipse.jetty.http2:jetty-http2-common (Maven): upgrade to 12.0.2 or later; org.eclipse.jetty.http2:jetty-http2-server (Maven): upgrade to 12.0.2 or later; github.com/apple/swift-nio-http2 (Swift): upgrade to 1.28.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-44487 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-44487?
Check whether you run Akka HTTP Core, Apache HTTP Server, Apache Tomcat or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • golang.org/x/net (Go): upgrade to 0.17.0 or later
    go get golang.org/x/net@v0.17.0
  • com.typesafe.akka:akka-http-core (Maven): upgrade to 10.5.3 or later
    # set com.typesafe.akka:akka-http-core to 10.5.3 in your pom.xml or build.gradle
  • com.typesafe.akka:akka-http-core_2.12 (Maven): upgrade to 10.5.3 or later
    # set com.typesafe.akka:akka-http-core_2.12 to 10.5.3 in your pom.xml or build.gradle
  • com.typesafe.akka:akka-http-core_2.13 (Maven): upgrade to 10.5.3 or later
    # set com.typesafe.akka:akka-http-core_2.13 to 10.5.3 in your pom.xml or build.gradle
  • org.apache.tomcat:tomcat-coyote (Maven): upgrade to 11.0.0-M12 or later
    # set org.apache.tomcat:tomcat-coyote to 11.0.0-M12 in your pom.xml or build.gradle
  • org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 11.0.0-M12 or later
    # set org.apache.tomcat.embed:tomcat-embed-core to 11.0.0-M12 in your pom.xml or build.gradle
  • org.eclipse.jetty.http2:http2-common (Maven): upgrade to 9.4.53 or later
    # set org.eclipse.jetty.http2:http2-common to 9.4.53 in your pom.xml or build.gradle
  • org.eclipse.jetty.http2:http2-server (Maven): upgrade to 9.4.53 or later
    # set org.eclipse.jetty.http2:http2-server to 9.4.53 in your pom.xml or build.gradle
  • org.eclipse.jetty.http2:jetty-http2-common (Maven): upgrade to 12.0.2 or later
    # set org.eclipse.jetty.http2:jetty-http2-common to 12.0.2 in your pom.xml or build.gradle
  • org.eclipse.jetty.http2:jetty-http2-server (Maven): upgrade to 12.0.2 or later
    # set org.eclipse.jetty.http2:jetty-http2-server to 12.0.2 in your pom.xml or build.gradle
  • github.com/apple/swift-nio-http2 (Swift): upgrade to 1.28.0 or later

Technical details

The vulnerability, classified as a Denial of Service (DoS), stems from the HTTP/2 protocol's handling of RST_STREAM frames. An attacker can send a request frame followed immediately by a RST_STREAM frame; because the cancellation is unilateral and does not count against the MAX_CONCURRENT_STREAMS limit, the attacker can maintain an indefinite number of requests in flight. The server still incurs the overhead of stream allocation, header decompression, and request parsing before the reset is processed, creating a significant cost asymmetry. In specific implementations like swift-nio-http2, this can exhaust the EventLoop by forcing the creation of new Channels for discarded work. Patches typically involve implementing a sliding window to rate-limit the number of stream resets allowed per connection.

Affected products

  • Apple swift-nio-http2 < 1.28.0
  • Akka akka-http-core < 10.5.3
  • Apache tomcat-embed-core 8.5.0 to 8.5.93, 9.0.0 to 9.0.80, 10.0.0 to 10.1.13, 11.0.0-M1 to 11.0.0-M11
  • Eclipse Jetty http2-server 9.3.0 to 9.4.52, 10.0.0 to 10.0.16, 11.0.0 to 11.0.16, 12.0.0 to 12.0.1
  • Go net < 0.17.0

Identifiers

  • CVE-2023-44487
  • GHSA-qppj-fm5r-hxr3

Timeline

  • 2023-10-10: advisory: Original disclosure of the HTTP/2 Rapid Reset attack
  • 2023-10-10: patched: swift-nio-http2 version 1.28.0 released with remediation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.