CVE-2023-44487
KEVHIGH 7.5EPSS 100.0%
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
- CVSS v4.0
- 6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:A - CVSS v3.1
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS v3.1
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS v3.1
- 5.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H - EPSS
- 100.00% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2023-10-10
- Published
- 2023-10-10
- Updated
- 2026-07-14
Proof-of-concept exploits (25)
- arkrwn/PoC/tree/main/CVE-2023-44487
- micrictor/http2-rst-stream6★ · 2023-10-11
- BMG-Black-Magic/CVE-2023-444870★ · 2025-02-19
- ByteHackr/CVE-2023-444870★ · 2023-10-12
- ReToCode/golang-CVE-2023-444872★ · 2023-10-26
- TYuan0816/cve-2023-444870★ · 2024-04-22
- aulauniversal/CVE-2023-444871★ · 2025-01-18
- bcdannyboy/CVE-2023-44487247★ · 2024-01-08
- gmh5225/CVE_2023_44487-Rapid_Reset0★ · 2025-07-25
- imabee101/CVE-2023-4448756★ · 2023-10-13
- knabben/dos-poc5★ · 2024-04-16
- madhusudhan-in/CVE_2023_44487-Rapid_Reset1★ · 2026-08-05
- moften/CVE-2022-4174_CVE-2022-417420★ · 2025-03-31
- moften/CVE-2023-44487-HTTP-2-Rapid-Reset-Attack2★ · 2025-11-06
- nxenon/cve-2023-4448715★ · 2023-11-10
- oscerd/nice-cve-poc1★ · 2023-12-01
- sigridou/CVE-2023-44487-0★ · 2023-12-11
- studiogangster/CVE-2023-4448722★ · 2023-10-16
- threatlabindonesia/CVE-2023-44487-HTTP-2-Rapid-Reset-Exploit-PoC10★ · 2025-12-16
- zanks08/cve-2023-44487-demo1★ · 2025-04-22
- CerberusMrXi/CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit
- ReGeLePuMa/HTTP-2-Rapid-Reset-DDos
- tahaXafous/CVE-2023-44487-dos
- tpirate/cve-2023-44487-POC
- irvik00/Homework_11