{"items":[{"id":"NVI-00000384","kind":"vulnerability","title":"HTTP/2 Stream Cancellation Attack","revision":5,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","CISA catalog date-added and due-date fields are not the original vulnerability disclosure date or universal legal deadlines.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-qppj-fm5r-hxr3","CVE-2023-44487"],"plain_summary":"GitHub lists this reviewed advisory for golang.org/x/net, org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat.embed:tomcat-embed-core. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2250e5afca14c7d18092efebbf2ca379"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","source_ids":["sr-35b60f8bd3f9daed1d71d388cf80beec"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-05-13T15:25:13.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-6bbd99ce3dcc4e33607df67b43b4657d"},{"kind":"CISA_KEV","as_of":"2023-10-10T00:00:00.000Z","value":"Listed","meaning":"CISA lists known exploitation. This does not establish exploitation of your system.","source_id":"sr-35b60f8bd3f9daed1d71d388cf80beec"},{"kind":"CVSS","as_of":"2026-08-11T19:37:30.880Z","value":"7.5 HIGH (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-0f808de0b62c98172847954b3cf76e3d"},{"kind":"CVSS","as_of":"2026-08-11T19:37:30.880Z","value":"7.5 HIGH (3.1)","meaning":"134c704f-9b21-4f2e-91b3-4a467353bcc0 severity; no combined Null risk score.","source_id":"sr-0f808de0b62c98172847954b3cf76e3d"},{"kind":"EPSS","as_of":"2026-11-02T12:00:30.000Z","value":"99.999%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.99998. Missing scores are unknown.","source_id":"sr-2250e5afca14c7d18092efebbf2ca379"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6bbd99ce3dcc4e33607df67b43b4657d","url":"https://github.com/advisories/GHSA-qppj-fm5r-hxr3","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-qppj-fm5r-hxr3","publisher":"GitHub Advisory Database","observed_at":"2026-11-08T15:08:00.152Z"},{"id":"sr-35b60f8bd3f9daed1d71d388cf80beec","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","basis":"official_catalog","notes":"CISA KEV; CC0 1.0. Catalog assertions are not evidence of customer compromise.","title":"CVE-2023-44487","publisher":"CISA","observed_at":"2026-10-31T20:54:12.600Z"},{"id":"sr-0f808de0b62c98172847954b3cf76e3d","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2023-44487","publisher":"NIST National Vulnerability Database","observed_at":"2026-10-31T21:43:16.211Z"},{"id":"sr-2250e5afca14c7d18092efebbf2ca379","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2023-44487","publisher":"FIRST EPSS","observed_at":"2026-11-02T20:14:50.774Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"golang.org/x/net","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":["< 0.17.0"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"org.apache.tomcat.embed:tomcat-embed-core","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":[">= 11.0.0-M1, < 11.0.0-M12"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"org.apache.tomcat.embed:tomcat-embed-core","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":[">= 10.0.0, < 10.1.14"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"org.apache.tomcat.embed:tomcat-embed-core","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":[">= 9.0.0, < 9.0.81"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"org.apache.tomcat.embed:tomcat-embed-core","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":[">= 8.5.0, < 8.5.94"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"github.com/apple/swift-nio-http2","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":["< 1.28.0"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"org.eclipse.jetty.http2:http2-common","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":[">= 9.3.0, < 9.4.53"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"org.eclipse.jetty.http2:http2-common","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":[">= 10.0.0, < 10.0.17"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"org.eclipse.jetty.http2:http2-common","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":[">= 11.0.0, < 11.0.17"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"org.eclipse.jetty.http2:http2-server","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":[">= 9.3.0, < 9.4.53"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"org.eclipse.jetty.http2:http2-server","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":[">= 10.0.0, < 10.0.17"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"org.eclipse.jetty.http2:http2-server","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":[">= 11.0.0, < 11.0.17"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"org.eclipse.jetty.http2:jetty-http2-common","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":[">= 12.0.0, < 12.0.2"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"org.eclipse.jetty.http2:jetty-http2-server","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":[">= 12.0.0, < 12.0.2"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"com.typesafe.akka:akka-http-core","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":["< 10.5.3"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"com.typesafe.akka:akka-http-core_2.13","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":["< 10.5.3"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"com.typesafe.akka:akka-http-core_2.12","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":["< 10.5.3"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"com.typesafe.akka:akka-http-core_2.11","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":["<= 10.1.15"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"org.apache.tomcat:tomcat-coyote","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":[">= 11.0.0-M1, < 11.0.0-M12"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"org.apache.tomcat:tomcat-coyote","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":[">= 10.0.0, < 10.1.14"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"org.apache.tomcat:tomcat-coyote","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":[">= 9.0.0, < 9.0.81"]},{"certainty":"source_listed","source_ids":["sr-6bbd99ce3dcc4e33607df67b43b4657d"],"technology":"org.apache.tomcat:tomcat-coyote","known_exclusions":[],"conditions_summary":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight.","public_affected_ranges":[">= 8.5.0, < 8.5.94"]},{"certainty":"source_listed","source_ids":["sr-35b60f8bd3f9daed1d71d388cf80beec"],"technology":"IETF HTTP/2","known_exclusions":[],"conditions_summary":"CISA does not supply a complete application-specific affected range here. Follow the linked vendor advisory for version and configuration prerequisites.","public_affected_ranges":[]}],"null_published_at":"2026-11-08T15:11:47.516Z","source_updated_at":"2026-05-13T15:25:13.000Z","source_disclosed_at":"2023-10-10T21:28:24.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T20:54:12.600Z"},{"id":"NVI-00000384","kind":"vulnerability","title":"HTTP/2 Rapid Reset Attack Vulnerability","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","CISA catalog date-added and due-date fields are not the original vulnerability disclosure date or universal legal deadlines.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["CVE-2023-44487"],"plain_summary":"CISA lists CVE-2023-44487 in its Known Exploited Vulnerabilities catalog. The catalog names IETF HTTP/2; it does not establish that a particular visitor is exposed or compromised.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","source_ids":["sr-35b60f8bd3f9daed1d71d388cf80beec"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2250e5afca14c7d18092efebbf2ca379"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CISA_KEV","as_of":"2023-10-10T00:00:00.000Z","value":"Listed","meaning":"CISA lists known exploitation. This does not establish exploitation of your system.","source_id":"sr-35b60f8bd3f9daed1d71d388cf80beec"},{"kind":"CVSS","as_of":"2026-08-11T19:37:30.880Z","value":"7.5 HIGH (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-0f808de0b62c98172847954b3cf76e3d"},{"kind":"CVSS","as_of":"2026-08-11T19:37:30.880Z","value":"7.5 HIGH (3.1)","meaning":"134c704f-9b21-4f2e-91b3-4a467353bcc0 severity; no combined Null risk score.","source_id":"sr-0f808de0b62c98172847954b3cf76e3d"},{"kind":"EPSS","as_of":"2026-11-02T12:00:30.000Z","value":"99.999%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.99998. Missing scores are unknown.","source_id":"sr-2250e5afca14c7d18092efebbf2ca379"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-35b60f8bd3f9daed1d71d388cf80beec","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","basis":"official_catalog","notes":"CISA KEV; CC0 1.0. Catalog assertions are not evidence of customer compromise.","title":"CVE-2023-44487","publisher":"CISA","observed_at":"2026-10-31T20:54:12.600Z"},{"id":"sr-0f808de0b62c98172847954b3cf76e3d","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2023-44487","publisher":"NIST National Vulnerability Database","observed_at":"2026-10-31T21:43:16.211Z"},{"id":"sr-2250e5afca14c7d18092efebbf2ca379","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2023-44487","publisher":"FIRST EPSS","observed_at":"2026-11-02T20:14:50.774Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-35b60f8bd3f9daed1d71d388cf80beec"],"technology":"IETF HTTP/2","known_exclusions":[],"conditions_summary":"CISA does not supply a complete application-specific affected range here. Follow the linked vendor advisory for version and configuration prerequisites.","public_affected_ranges":[]}],"null_published_at":"2026-11-07T14:01:58.740Z","source_updated_at":"2023-10-10T00:00:00.000Z","source_disclosed_at":null,"is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T20:54:12.600Z"},{"id":"NVI-00000384","kind":"vulnerability","title":"HTTP/2 Rapid Reset Attack Vulnerability","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","CISA catalog date-added and due-date fields are not the original vulnerability disclosure date or universal legal deadlines.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["CVE-2023-44487"],"plain_summary":"CISA lists CVE-2023-44487 in its Known Exploited Vulnerabilities catalog. The catalog names IETF HTTP/2; it does not establish that a particular visitor is exposed or compromised.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","source_ids":["sr-35b60f8bd3f9daed1d71d388cf80beec"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-41db39184704e0266358acf97881bf3a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CISA_KEV","as_of":"2023-10-10T00:00:00.000Z","value":"Listed","meaning":"CISA lists known exploitation. This does not establish exploitation of your system.","source_id":"sr-35b60f8bd3f9daed1d71d388cf80beec"},{"kind":"CVSS","as_of":"2026-08-11T19:37:30.880Z","value":"7.5 HIGH (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-0f808de0b62c98172847954b3cf76e3d"},{"kind":"CVSS","as_of":"2026-08-11T19:37:30.880Z","value":"7.5 HIGH (3.1)","meaning":"134c704f-9b21-4f2e-91b3-4a467353bcc0 severity; no combined Null risk score.","source_id":"sr-0f808de0b62c98172847954b3cf76e3d"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"99.999%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.99998. Missing scores are unknown.","source_id":"sr-41db39184704e0266358acf97881bf3a"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-35b60f8bd3f9daed1d71d388cf80beec","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","basis":"official_catalog","notes":"CISA KEV; CC0 1.0. Catalog assertions are not evidence of customer compromise.","title":"CVE-2023-44487","publisher":"CISA","observed_at":"2026-10-31T20:54:12.600Z"},{"id":"sr-0f808de0b62c98172847954b3cf76e3d","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2023-44487","publisher":"NIST National Vulnerability Database","observed_at":"2026-10-31T21:43:16.211Z"},{"id":"sr-41db39184704e0266358acf97881bf3a","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2023-44487","publisher":"FIRST EPSS","observed_at":"2026-10-31T21:41:13.231Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-35b60f8bd3f9daed1d71d388cf80beec"],"technology":"IETF HTTP/2","known_exclusions":[],"conditions_summary":"CISA does not supply a complete application-specific affected range here. Follow the linked vendor advisory for version and configuration prerequisites.","public_affected_ranges":[]}],"null_published_at":"2026-10-31T21:53:28.041Z","source_updated_at":"2023-10-10T00:00:00.000Z","source_disclosed_at":null,"is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T20:54:12.600Z"},{"id":"NVI-00000384","kind":"vulnerability","title":"HTTP/2 Rapid Reset Attack Vulnerability","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","CISA catalog date-added and due-date fields are not the original vulnerability disclosure date or universal legal deadlines."],"lifecycle":"active","identifiers":["CVE-2023-44487"],"plain_summary":"CISA lists CVE-2023-44487 in its Known Exploited Vulnerabilities catalog. The catalog names IETF HTTP/2; it does not establish that a particular visitor is exposed or compromised.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","source_ids":["sr-35b60f8bd3f9daed1d71d388cf80beec"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CISA_KEV","as_of":"2023-10-10T00:00:00.000Z","value":"Listed","meaning":"CISA lists known exploitation. This does not establish exploitation of your system.","source_id":"sr-35b60f8bd3f9daed1d71d388cf80beec"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-35b60f8bd3f9daed1d71d388cf80beec","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","basis":"official_catalog","notes":"CISA KEV; CC0 1.0. Catalog assertions are not evidence of customer compromise.","title":"CVE-2023-44487","publisher":"CISA","observed_at":"2026-10-31T20:54:12.600Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-35b60f8bd3f9daed1d71d388cf80beec"],"technology":"IETF HTTP/2","known_exclusions":[],"conditions_summary":"CISA does not supply a complete application-specific affected range here. Follow the linked vendor advisory for version and configuration prerequisites.","public_affected_ranges":[]}],"null_published_at":"2026-10-31T21:27:35.497Z","source_updated_at":"2023-10-10T00:00:00.000Z","source_disclosed_at":null,"is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T20:54:12.600Z"}],"next_cursor":null,"snapshot_revision":"42594"}