The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/44xxx/CVE-2023-44487.json",
"cna_assigner": "mitre"
}{
"cpe": "cpe:2.3:a:akka:http_server:*:*:*:*:*:*:*:*",
"source": "CPE_RANGE",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "10.5.3"
}
]
}"2026-08-02T14:31:13Z"
[
{
"signature_type": "Line",
"target": {
"file": "solr/solrj-zookeeper/src/java/org/apache/solr/common/cloud/ClusterProperties.java"
},
"deprecated": false,
"source": "https://github.com/apache/solr/commit/71e101bb37497f730078d9afe1991b60d10bfe96",
"id": "CVE-2023-44487-1d75e3ae",
"signature_version": "v1",
"digest": {
"line_hashes": [
"328392780327022616232592932747945111915",
"237657762462344934055526225808371591655",
"323800155442678667737596367194170243812",
"290062371794872308484858904222114607176"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "solr/core/src/java/org/apache/solr/cloud/ZkCLI.java"
},
"deprecated": false,
"source": "https://github.com/apache/solr/commit/71e101bb37497f730078d9afe1991b60d10bfe96",
"id": "CVE-2023-44487-adbbd0dc",
"signature_version": "v1",
"digest": {
"line_hashes": [
"96458608783253083586626325045805789884",
"145522882445360041683055852128286161144",
"309931195073256237902336501619192928175",
"13386222136100787363592435200166865262",
"96458608783253083586626325045805789884",
"145522882445360041683055852128286161144",
"42204928388511559801424355220728707911",
"222015197229070154472973636937113480309"
],
"threshold": 0.9
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-44487.json"
{
"cpe": [
"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*"
],
"source": [
"CPE_RANGE",
"CPE_STRING"
],
"extracted_events": [
{
"introduced": "8.5.0"
},
{
"last_affected": "8.5.93"
},
{
"introduced": "9.0.0"
},
{
"last_affected": "9.0.80"
},
{
"introduced": "10.1.0"
},
{
"last_affected": "10.1.13"
},
{
"introduced": "11.0.0-milestone1"
},
{
"last_affected": "11.0.0-milestone1"
},
{
"introduced": "11.0.0-milestone10"
},
{
"last_affected": "11.0.0-milestone10"
},
{
"introduced": "11.0.0-milestone11"
},
{
"last_affected": "11.0.0-milestone11"
},
{
"introduced": "11.0.0-milestone2"
},
{
"last_affected": "11.0.0-milestone2"
},
{
"introduced": "11.0.0-milestone3"
},
{
"last_affected": "11.0.0-milestone3"
},
{
"introduced": "11.0.0-milestone4"
},
{
"last_affected": "11.0.0-milestone4"
},
{
"introduced": "11.0.0-milestone5"
},
{
"last_affected": "11.0.0-milestone5"
},
{
"introduced": "11.0.0-milestone6"
},
{
"last_affected": "11.0.0-milestone6"
},
{
"introduced": "11.0.0-milestone7"
},
{
"last_affected": "11.0.0-milestone7"
},
{
"introduced": "11.0.0-milestone8"
},
{
"last_affected": "11.0.0-milestone8"
},
{
"introduced": "11.0.0-milestone9"
},
{
"last_affected": "11.0.0-milestone9"
}
]
}{
"cpe": "cpe:2.3:a:apple:swiftnio_http\\/2:*:*:*:*:*:swift:*:*",
"source": "CPE_RANGE",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "1.28.0"
}
]
}{
"cpe": "cpe:2.3:a:microsoft:azure_kubernetes_service:*:*:*:*:*:*:*:*",
"source": "CPE_RANGE",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "2023-10-08"
}
]
}{
"cpe": "cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*",
"source": [
"CPE_RANGE",
"REFERENCES"
],
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "2.7.5"
}
]
}{
"cpe": [
"cpe:2.3:a:envoyproxy:envoy:1.24.10:*:*:*:*:*:*:*",
"cpe:2.3:a:envoyproxy:envoy:1.25.9:*:*:*:*:*:*:*",
"cpe:2.3:a:envoyproxy:envoy:1.26.4:*:*:*:*:*:*:*",
"cpe:2.3:a:envoyproxy:envoy:1.27.0:*:*:*:*:*:*:*"
],
"source": "CPE_STRING",
"extracted_events": [
{
"introduced": "1.24.10"
},
{
"last_affected": "1.24.10"
},
{
"introduced": "1.25.9"
},
{
"last_affected": "1.25.9"
},
{
"introduced": "1.26.4"
},
{
"last_affected": "1.26.4"
},
{
"introduced": "1.27.0"
},
{
"last_affected": "1.27.0"
}
]
}{
"cpe": "cpe:2.3:a:facebook:proxygen:*:*:*:*:*:*:*:*",
"source": "CPE_RANGE",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "2023.10.16.00"
}
]
}{
"cpe": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
"source": "CPE_RANGE",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "1.20.10"
},
{
"introduced": "1.21.0"
},
{
"fixed": "1.21.3"
}
]
}{
"cpe": [
"cpe:2.3:a:grpc:grpc:*:*:*:*:*:go:*:*",
"cpe:2.3:a:grpc:grpc:*:*:*:*:*:-:*:*",
"cpe:2.3:a:grpc:grpc:1.57.0:-:*:*:*:go:*:*"
],
"source": [
"CPE_RANGE",
"CPE_STRING",
"REFERENCES"
],
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "1.56.3"
},
{
"last_affected": "1.59.2"
},
{
"introduced": "1.58.0"
},
{
"fixed": "1.58.3"
},
{
"introduced": "1.57.0-NA"
},
{
"last_affected": "1.57.0-NA"
}
]
}{
"cpe": [
"cpe:2.3:a:grpc:grpc:*:*:*:*:*:go:*:*",
"cpe:2.3:a:grpc:grpc:1.57.0:-:*:*:*:go:*:*"
],
"source": [
"CPE_RANGE",
"CPE_STRING"
],
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "1.56.3"
},
{
"introduced": "1.58.0"
},
{
"fixed": "1.58.3"
},
{
"introduced": "1.57.0-NA"
},
{
"last_affected": "1.57.0-NA"
}
]
}{
"cpe": "cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*",
"source": "CPE_RANGE",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "1.17.6"
},
{
"introduced": "1.18.0"
},
{
"fixed": "1.18.3"
},
{
"introduced": "1.19.0"
},
{
"fixed": "1.19.1"
}
]
}{
"cpe": [
"cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*",
"cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*"
],
"source": "CPE_RANGE",
"extracted_events": [
{
"introduced": "0"
},
{
"last_affected": "2.414.2"
},
{
"last_affected": "2.427"
}
]
}{
"cpe": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
"source": "CPE_RANGE",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "9.4.53"
},
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.17"
},
{
"introduced": "11.0.0"
},
{
"fixed": "11.0.17"
},
{
"introduced": "12.0.0"
},
{
"fixed": "12.0.2"
}
]
}{
"cpe": "cpe:2.3:a:kazu-yamamoto:http2:*:*:*:*:*:*:*:*",
"source": [
"CPE_RANGE",
"REFERENCES"
],
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "4.2.2"
}
]
}{
"cpe": "cpe:2.3:a:konghq:kong_gateway:*:*:*:*:enterprise:*:*:*",
"source": "CPE_RANGE",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "3.4.2"
}
]
}{
"cpe": [
"cpe:2.3:a:linkerd:linkerd:*:*:*:*:stable:kubernetes:*:*",
"cpe:2.3:a:linkerd:linkerd:2.13.0:*:*:*:stable:kubernetes:*:*",
"cpe:2.3:a:linkerd:linkerd:2.13.1:*:*:*:stable:kubernetes:*:*",
"cpe:2.3:a:linkerd:linkerd:2.14.0:*:*:*:stable:kubernetes:*:*",
"cpe:2.3:a:linkerd:linkerd:2.14.1:*:*:*:stable:kubernetes:*:*"
],
"source": [
"CPE_RANGE",
"CPE_STRING"
],
"extracted_events": [
{
"introduced": "2.12.0"
},
{
"last_affected": "2.12.5"
},
{
"introduced": "2.13.0"
},
{
"last_affected": "2.13.0"
},
{
"introduced": "2.13.1"
},
{
"last_affected": "2.13.1"
},
{
"introduced": "2.14.0"
},
{
"last_affected": "2.14.0"
},
{
"introduced": "2.14.1"
},
{
"last_affected": "2.14.1"
}
]
}{
"cpe": [
"cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:*",
"cpe:2.3:a:ietf:http:2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:3scale_api_management_platform:2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:cryostat:2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:openshift_service_mesh:2.0:*:*:*:*:*:*:*"
],
"source": [
"CPE_RANGE",
"CPE_STRING"
],
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "3.0"
},
{
"introduced": "2.0"
},
{
"last_affected": "2.0"
}
]
}{
"cpe": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
"source": [
"CPE_RANGE",
"REFERENCES"
],
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "4.1.100"
}
]
}"2026-08-02T14:31:13Z"
[
{
"signature_type": "Line",
"target": {
"file": "codec-http2/src/main/java/io/netty/handler/codec/http2/AbstractHttp2ConnectionHandlerBuilder.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61",
"id": "CVE-2023-44487-316dc442",
"signature_version": "v1",
"digest": {
"line_hashes": [
"125653841197755015383824085277395303348",
"90418587286054842174517546781689668578",
"151242893358356810592204537174328377728",
"39893465424968585855307447200384440857",
"255665036340097661680623602812006508047",
"175832492354488066379649821142738785749",
"217820127006468297893954384014110769203",
"45503679288625033659896703612419790998",
"203678239741338965265560476255201408556",
"26647441025014002737278366428472284756",
"214268563287895355931266018920676640314",
"326725953729396929244827591844043620568",
"287743702612693595655651666470853231804",
"280682175060858981970542351060069250410",
"164882572200281737650816636634160836745",
"135745700086611110039446803415426203221",
"184478615219231105271671502653528822815"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "codec-http2/src/test/java/io/netty/handler/codec/http2/Http2EmptyDataFrameConnectionDecoderTest.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61",
"id": "CVE-2023-44487-396bc60a",
"signature_version": "v1",
"digest": {
"line_hashes": [
"16735128250395063398141887077049053742",
"65294614127459941946307055286129098191",
"277430768673836084511343809579198895862",
"103372399134332054939248432284104540540",
"238798030421717051437763159167025399488",
"81096357800483170626125468848033922878",
"153804175243775834163807606123820043951",
"52521870671296124989521093171926806498",
"194005468057387631812701794470237768011",
"333700852061655906066052207224633564228",
"304845782338742972530716022272444441953",
"271236924675914146234721144301392245446",
"78269309098620982866867106289155000969",
"288885498558228198286238179279824487251",
"73653074389916922318080804193917209741",
"125412958094124814796670713864970374852",
"172435094042166061091601672582797746991",
"125333170306924586976060012907004280044",
"338143110237770229409247235671510195847",
"32438289396276550613948674520925674990",
"28199600148976914439998831223350748650",
"320386303651994676700322115949793400166",
"339173214183602301590023767829271839521",
"76556667333872069465724770437751404723",
"9401768708171708196925050928953207314",
"4688725266895228616458641659678759166",
"57063629870321924651018731012497520992",
"154920922165130022281584794232586234094",
"86042005517765526587370047814600680586",
"52342039113735602673964372912217535750",
"329491445113934849905435327340288555755",
"177185184524246663766121475782238307307",
"267227223180714821027068557741028826827",
"66216846262297558993246968303090113125",
"232634522799228696895558487346169934959",
"76586462288042028935997856620061239150"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "codec-http2/src/main/java/io/netty/handler/codec/http2/AbstractHttp2ConnectionHandlerBuilder.java",
"function": "buildFromCodec"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61",
"id": "CVE-2023-44487-4dcf71aa",
"signature_version": "v1",
"digest": {
"function_hash": "201182205581498582350704174032005350866",
"length": 513.0
}
},
{
"signature_type": "Function",
"target": {
"file": "codec-http2/src/test/java/io/netty/handler/codec/http2/Http2EmptyDataFrameConnectionDecoderTest.java",
"function": "testDecoration"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61",
"id": "CVE-2023-44487-62d37ea7",
"signature_version": "v1",
"digest": {
"function_hash": "75416424745415690959836396218773344287",
"length": 645.0
}
},
{
"signature_type": "Line",
"target": {
"file": "codec-http2/src/main/java/io/netty/handler/codec/http2/Http2FrameCodecBuilder.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61",
"id": "CVE-2023-44487-662b95ca",
"signature_version": "v1",
"digest": {
"line_hashes": [
"33134734909587663339818629659976090823",
"272048144275268619834493568780310487596",
"224826635466754118933900601091791444299"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "codec-http2/src/main/java/io/netty/handler/codec/http2/Http2MultiplexCodecBuilder.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61",
"id": "CVE-2023-44487-b2682bbf",
"signature_version": "v1",
"digest": {
"line_hashes": [
"180662945750400519118145642308779674614",
"62306042824350136150524994252417120434",
"188854520484551783617200803370691804218"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "codec-http2/src/test/java/io/netty/handler/codec/http2/Http2EmptyDataFrameConnectionDecoderTest.java",
"function": "testDecorationWithNull"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61",
"id": "CVE-2023-44487-d6d21cf1",
"signature_version": "v1",
"digest": {
"function_hash": "223971630053580329111965032198166109919",
"length": 159.0
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-44487.json"
{
"cpe": "cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*",
"source": [
"CPE_RANGE",
"REFERENCES"
],
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "1.57.0"
}
]
}{
"cpe": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*",
"source": "CPE_RANGE",
"extracted_events": [
{
"introduced": "2.0.0"
},
{
"last_affected": "2.4.2"
},
{
"introduced": "3.0.0"
},
{
"last_affected": "3.3.0"
}
]
}{
"cpe": "cpe:2.3:a:openresty:openresty:*:*:*:*:*:*:*:*",
"source": "CPE_RANGE",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "1.21.4.3"
}
]
}{
"cpe": "cpe:2.3:a:amazon:opensearch_data_prepper:*:*:*:*:*:*:*:*",
"source": "CPE_RANGE",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "2.5.0"
}
]
}{
"cpe": [
"cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*",
"cpe:2.3:a:siemens:st7_scadaconnect:*:*:*:*:*:*:*:*",
"cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*",
"cpe:2.3:a:redhat:service_interconnect:1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*",
"cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:*",
"cpe:2.3:a:redhat:openshift_virtualization:4:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:service_telemetry_framework:1.5:*:*:*:*:*:*:*"
],
"source": [
"CPE_RANGE",
"CPE_STRING"
],
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "1.0"
},
{
"fixed": "1.1"
},
{
"introduced": "1.0-NA"
},
{
"last_affected": "1.0-NA"
},
{
"introduced": "1.0"
},
{
"last_affected": "1.0"
},
{
"introduced": "1.0-sp1"
},
{
"last_affected": "1.0-sp1"
},
{
"introduced": "1.0-sp2"
},
{
"last_affected": "1.0-sp2"
},
{
"introduced": "4"
},
{
"last_affected": "4"
},
{
"introduced": "1.5"
},
{
"last_affected": "1.5"
}
]
}{
"cpe": [
"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
"cpe:2.3:a:traefik:traefik:3.0.0:beta1:*:*:*:*:*:*",
"cpe:2.3:a:traefik:traefik:3.0.0:beta2:*:*:*:*:*:*",
"cpe:2.3:a:traefik:traefik:3.0.0:beta3:*:*:*:*:*:*"
],
"source": [
"CPE_RANGE",
"CPE_STRING"
],
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "2.10.5"
},
{
"introduced": "3.0.0-beta1"
},
{
"last_affected": "3.0.0-beta1"
},
{
"introduced": "3.0.0-beta2"
},
{
"last_affected": "3.0.0-beta2"
},
{
"introduced": "3.0.0-beta3"
},
{
"last_affected": "3.0.0-beta3"
}
]
}