CVE-2023-44487: IETF HTTP/2

Should you act?

Exploited: patch now if you run it

CISA has confirmed exploitation in the wild. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

Yes, if you run IETF HTTP/2. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2023-10-10, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2023-10-31; treat that as the outer limit, not the target.
EPSS 100.0%, percentile 100.0: FIRST’s model estimates a 100.0% chance of exploitation activity in the next 30 days, higher than 100.0% of all scored CVEs (very high). EPSS is a probability, not a verdict.
Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
Editorial verdict: Check exposure. HTTP/2 Rapid Reset: Record DDoS Flaw in HTTP/2 Servers — This is availability-only and was exploited at record scale, but if your HTTP/2 traffic terminates at a major CDN or cloud load balancer the provider already absorbed it; check what terminates HTTP/2 on your own servers.

What it is

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CISA’s summary

HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).

Weakness type: CWE-400.

Product: IETF HTTP/2 · Assigned by: mitre · Published: 2023-10-10

Affected and fixed versions

Vendor	Product	Affected versions (per CVE record)
n/a	n/a	see vendor advisory

Severity scores

Scored by	CVSS	Score	Vector
CISA-ADP	3.1	7.5 High	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Attack vector: network (remotely reachable)
Attack complexity: low
Privileges required: none (no login)
User interaction: none
Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

CISA KEV: added 2023-10-10; federal due date 2023-10-31. Known ransomware use: Unknown.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA SSVC assessment: exploitation active, automatable yes, technical impact partial.
FIRST EPSS (model of 2026-10-21): 100.00% probability of exploitation activity in the next 30 days; percentile 100.0.

Timeline

2023-10-10 — Added to CISA’s Known Exploited Vulnerabilities catalog
2023-10-10 — CVE record published by mitre
2023-10-10 — erroneo.us brief: HTTP/2 Rapid Reset: Record DDoS Flaw in HTTP/2 Servers
2023-10-31 — CISA remediation deadline for US federal agencies
2026-10-14 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vendor and project advisories, patches

DSA-5522 debian.org
DSA-5521 debian.org
FEDORA-2023-ed2642fd58 lists.fedoraproject.org
FEDORA-2023-54fadada12 lists.fedoraproject.org
FEDORA-2023-5ff7bf1dd8 lists.fedoraproject.org
FEDORA-2023-17efd3f2cd lists.fedoraproject.org
FEDORA-2023-d5030c983c lists.fedoraproject.org
FEDORA-2023-0259c3f26f lists.fedoraproject.org
FEDORA-2023-2a9214af5f lists.fedoraproject.org
FEDORA-2023-e9c04d81c1 lists.fedoraproject.org
FEDORA-2023-f66fc0f62a lists.fedoraproject.org
FEDORA-2023-4d2fd884ea lists.fedoraproject.org
FEDORA-2023-b2c50535cb lists.fedoraproject.org
FEDORA-2023-fe53e13b5b lists.fedoraproject.org
Listed in CISA KEV notes (blog.cloudflare.com) blog.cloudflare.com