io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack

published 2023-10-10 3y ago modified 2026-09-10 2mo ago

cvss: 7.5; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.

### Impact This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.

### Patches This is patched in version 4.1.100.Final.

### Workarounds A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own `Http2FrameListener` implementation or an `ChannelInboundHandler` implementation (depending which http2 API is used).

### References - https://www.cve.org/CVERecord?id=CVE-2023-44487 - https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ - https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

Patch / fix

fixed in 1 links 1

maven io.netty:netty-codec-http2 4.1.100.Final

github.com/netty/netty@58f75f6 commit

Is GHSA-xpw8-rcwv-8f8p in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	io.netty:netty-codec-http2	<4.1.100.Final	4.1.100.Final

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

References

Sources

GitHub Advisory GHSA-xpw8-rcwv-8f8p

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.