DEBIAN-CVE-2023-44487

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2023-44487
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2023-44487
Upstream
Downstream
Published
2023-10-10T14:15:10Z
Modified
2026-09-15T09:02:25Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

References

Affected packages

Debian:12
dnsdist

Package

Name
dnsdist
Purl
pkg:deb/debian/dnsdist?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.7.3-2
1.8.0-1
1.8.1-1
1.8.2-1
1.8.2-2
1.8.2-3
1.8.3-1
1.8.3-2
1.8.3-3
1.9.3-1
1.9.4-1
1.9.5-1
1.9.6-1
1.9.8-1
1.9.9-1
1.9.10-1
2.*
2.0.0~rc1-1
2.0.0~rc1-2
2.0.0~rc2-1
2.0.0-1
2.0.0-2
2.0.0-3
2.0.0-4
2.0.0-5
2.0.0-6
2.0.1-1
2.0.2-1
2.0.3-1
2.0.4-1
2.0.5-1
2.0.5-2
2.0.5-3
2.0.6-1
2.1.0-1
2.1.0-2
2.1.1-1
2.1.2-1

Ecosystem specific 

{
    "urgency": "end-of-life"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
grpc

Package

Name
grpc
Purl
pkg:deb/debian/grpc?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.51.1-3
1.51.1-4
1.51.1-4.1~exp1
1.51.1-4.1
1.51.1-5
1.51.1-6
1.51.1-7
1.51.1-8
1.51.1-9
1.59.5-1
1.82.0-1
1.83.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
h2o

Package

Name
h2o
Purl
pkg:deb/debian/h2o?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.2.5+dfsg2-7
2.2.5+dfsg2-8
2.2.5+dfsg2-8.1~exp1
2.2.5+dfsg2-8.1
2.2.5+dfsg2-9
2.2.5+dfsg2-10
2.2.5+dfsg2-11

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
haproxy

Package

Name
haproxy
Purl
pkg:deb/debian/haproxy?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.8.13-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
jetty9

Package

Name
jetty9
Purl
pkg:deb/debian/jetty9?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.4.50-4+deb12u2

Affected versions

9.*
9.4.50-4
9.4.50-4+deb12u1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
netty

Package

Name
netty
Purl
pkg:deb/debian/netty?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1:4.1.48-7+deb12u1

Affected versions

1:4.*
1:4.1.48-7

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
nghttp2

Package

Name
nghttp2
Purl
pkg:deb/debian/nghttp2?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.52.0-1+deb12u1

Affected versions

1.*
1.52.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
nginx

Package

Name
nginx
Purl
pkg:deb/debian/nginx?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.22.1-9
1.22.1-9+deb12u1
1.22.1-9+deb12u2
1.22.1-9+deb12u3
1.22.1-9+deb12u4
1.22.1-9+deb12u5
1.22.1-9+deb12u6
1.22.1-9+deb12u7
1.22.1-9+deb12u8
1.22.1-9+deb12u9
1.24.0-1~exp1
1.24.0-1
1.24.0-2
1.26.0-1~exp1
1.26.0-1
1.26.0-2
1.26.0-3
1.26.2-1
1.26.3-1
1.26.3-2
1.26.3-3
1.28.0-1
1.28.0-2
1.28.0-3
1.28.0-4
1.28.0-5
1.28.0-6
1.28.1-1
1.28.1-2
1.28.1-3
1.28.2-1
1.28.2-2
1.28.2-3
1.28.2-4
1.28.3-1
1.28.3-2
1.30.0-1
1.30.0-2
1.30.0-3
1.30.0-4
1.30.1-1
1.30.1-2
1.30.1-3
1.30.1-4
1.30.1-5
1.30.1-6
1.30.1-7
1.30.4-1
1.30.4-2
1.30.4-3
1.30.4-4
1.30.4-5
1.30.4-6

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
tomcat10

Package

Name
tomcat10
Purl
pkg:deb/debian/tomcat10?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
10.1.6-1+deb12u1

Affected versions

10.*
10.1.6-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
tomcat9

Package

Name
tomcat9
Purl
pkg:deb/debian/tomcat9?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.0.70-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
trafficserver

Package

Name
trafficserver
Purl
pkg:deb/debian/trafficserver?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.2.3+ds-1+deb12u1

Affected versions

9.*
9.2.0+ds-2
9.2.0+ds-2+deb12u1
9.2.1+ds-1
9.2.2+ds-1
9.2.3+ds-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
varnish

Package

Name
varnish
Purl
pkg:deb/debian/varnish?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

7.*
7.1.1-1.1
7.1.1-1.1+deb12u1
7.1.1-1.2
7.1.1-2+deb12u1
7.5.0-1
7.5.0-2
7.5.0-3
7.6.0-1
7.6.0-2
7.6.1-1
7.6.1-2
7.7.0-1
7.7.0-2
7.7.0-3
7.7.1-1
7.7.2-1
7.7.2-2
7.7.3-1
7.7.3-2
7.7.3-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
Debian:13
dnsdist

Package

Name
dnsdist
Purl
pkg:deb/debian/dnsdist?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.8.2-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
grpc

Package

Name
grpc
Purl
pkg:deb/debian/grpc?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.51.1-6
1.51.1-7
1.51.1-8
1.51.1-9
1.59.5-1
1.82.0-1
1.83.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
haproxy

Package

Name
haproxy
Purl
pkg:deb/debian/haproxy?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.8.13-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
jetty9

Package

Name
jetty9
Purl
pkg:deb/debian/jetty9?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.4.53-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
netty

Package

Name
netty
Purl
pkg:deb/debian/netty?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1:4.1.48-8

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
nghttp2

Package

Name
nghttp2
Purl
pkg:deb/debian/nghttp2?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.57.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
nginx

Package

Name
nginx
Purl
pkg:deb/debian/nginx?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.24.0-2

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
tomcat10

Package

Name
tomcat10
Purl
pkg:deb/debian/tomcat10?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
10.1.14-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
tomcat9

Package

Name
tomcat9
Purl
pkg:deb/debian/tomcat9?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.0.70-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
varnish

Package

Name
varnish
Purl
pkg:deb/debian/varnish?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
7.5.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
Debian:14
dnsdist

Package

Name
dnsdist
Purl
pkg:deb/debian/dnsdist?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.8.2-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
grpc

Package

Name
grpc
Purl
pkg:deb/debian/grpc?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.51.1-6
1.51.1-7
1.51.1-8
1.51.1-9
1.59.5-1
1.82.0-1
1.83.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
haproxy

Package

Name
haproxy
Purl
pkg:deb/debian/haproxy?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.8.13-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
jetty9

Package

Name
jetty9
Purl
pkg:deb/debian/jetty9?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.4.53-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
netty

Package

Name
netty
Purl
pkg:deb/debian/netty?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1:4.1.48-8

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
nghttp2

Package

Name
nghttp2
Purl
pkg:deb/debian/nghttp2?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.57.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
nginx

Package

Name
nginx
Purl
pkg:deb/debian/nginx?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.24.0-2

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
tomcat10

Package

Name
tomcat10
Purl
pkg:deb/debian/tomcat10?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
10.1.14-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"
tomcat9

Package

Name
tomcat9
Purl
pkg:deb/debian/tomcat9?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.0.70-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-44487.json"