CVE-2023-44487: HTTP/2 Protocol DOS Vulnerability

CVE-2023-44487 Overview

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Critical Impact

This vulnerability causes server resource exhaustion, leading to denial of service conditions across affected systems.

Affected Products

• ietf http
• nghttp2 nghttp2
• netty netty

Discovery Timeline

• Not Available - Vulnerability discovered
• Not Available - Responsible disclosure to ietf
• Not Available - CVE CVE-2023-44487 assigned
• Not Available - ietf releases security patch
• 2023-10-10 - CVE CVE-2023-44487 published to NVD
• 2025-11-07 - Last updated in NVD database

Technical Details for CVE-2023-44487

Vulnerability Analysis

This denial of service vulnerability in the HTTP/2 protocol allows an attacker to exploit request cancellations to reset an excessive number of streams. Such behavior can lead to severe resource exhaustion on the targeted server, effectively rendering services unavailable.

Root Cause

The root cause lies in the way HTTP/2 handles request cancellations, failing to limit the number of streams that can be reset sequentially without malicious intent.

Attack Vector

Network-based attack exploiting the lack of stream control in HTTP/2 request handling.

# Example exploitation code (sanitized)
import requests

url = "http://vulnerable-server.example"
headers = {"HTTP2-Settings": "max_concurrent_streams=1000000"}

for i in range(1000):
    requests.get(url, headers=headers)

Detection Methods for CVE-2023-44487

Indicators of Compromise

• High spike in stream reset events
• Unusual increase in resource consumption
• Sudden denial of service alerts

Detection Strategies

Deploy network monitoring to track the rate of HTTP/2 streams reset. Utilize logs to correlate the timing and source of excessive resets to detect potential exploitation attempts.

Monitoring Recommendations

Use SIEM tools to aggregate and analyze logs for unusual network traffic patterns that match DDoS signatures. Implement rate limiting on streams to detect abnormal behaviors.

How to Mitigate CVE-2023-44487

Immediate Actions Required

• Apply patches from vendors as they become available
• Implement rate limiting to handle excessive request cancellations
• Enable logging for HTTP/2 streams and monitor for anomalies

Patch Information

Ensure all affected systems are patched according to vendor recommendations as updates are released to address this vulnerability.

Workarounds

As a temporary workaround, configure your server to restrict the number of resettable streams.

# Configuration example
nghttpx --frontend-max-stream-stored=1000