Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

help request: What's the action for CVE-2023-44487 ? #10320

Closed
purekeeper opened this issue Oct 12, 2023 · 2 comments
Closed

help request: What's the action for CVE-2023-44487 ? #10320

purekeeper opened this issue Oct 12, 2023 · 2 comments

Comments

@purekeeper
Copy link

Description

A new vulnerability for http2, do we have any update fot this?
GHSA-qppj-fm5r-hxr3

Environment

  • APISIX version (run apisix version):
  • Operating system (run uname -a):
  • OpenResty / Nginx version (run openresty -V or nginx -V):
  • etcd version, if relevant (run curl http://127.0.0.1:9090/v1/server_info):
  • APISIX Dashboard version, if relevant:
  • Plugin runner version, for issues related to plugin runners:
  • LuaRocks version, for installation issues (run luarocks --version):
@moonming
Copy link
Member

@purekeeper thanks for raising this.

  1. Apache APISIX is implemented based on NGINX in HTTP2. The default value of this parameter of NGINX http://nginx.org/r/keepalive_requests is 1000, and APISIX does not modify it. In other words, sending a maximum of 1,000 requests on a connection will be disconnected, which can mitigate the attack caused by this CVE. You can also enable APISIX's limit-conn, limit-req and other plug-ins for further protection.
  2. APISIX Runtime has been patched with NGINX's commit: nginx/nginx@6ceef19, and a APISIX version will be released soon.

@moonming moonming mentioned this issue Oct 17, 2023
Closed
5 tasks
chaudum referenced this issue in grafana/loki Oct 17, 2023
@renovate
chore(deps): update module golang.org/x/net to v0.17.0 [security] (re…
8879a2d 
…lease-2.8.x) (#10891)

[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| golang.org/x/net | indirect | minor | `v0.7.0` -> `v0.17.0` |

---

### Improper rendering of text nodes in golang.org/x/net/html
[CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) /
[GHSA-2wrh-6pvc-2jm9](https://togithub.com/advisories/GHSA-2wrh-6pvc-2jm9)

<details>
<summary>More information</summary>

#### Details
Text nodes not in the HTML namespace are incorrectly literally rendered,
causing text which should be escaped to not be. This could lead to an
XSS attack.

#### Severity
- CVSS Score: 6.1 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

#### References
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978)
- [https://go.dev/cl/514896](https://go.dev/cl/514896)
- [https://go.dev/issue/61615](https://go.dev/issue/61615)
-
[https://pkg.go.dev/vuln/GO-2023-1988](https://pkg.go.dev/vuln/GO-2023-1988)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-2wrh-6pvc-2jm9) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Improper rendering of text nodes in golang.org/x/net/html
[CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) /
[GHSA-2wrh-6pvc-2jm9](https://togithub.com/advisories/GHSA-2wrh-6pvc-2jm9)
/ [GO-2023-1988](https://pkg.go.dev/vuln/GO-2023-1988)

<details>
<summary>More information</summary>

#### Details
Text nodes not in the HTML namespace are incorrectly literally rendered,
causing text which should be escaped to not be. This could lead to an
XSS attack.

#### Severity
Unknown

#### References
- [https://go.dev/issue/61615](https://go.dev/issue/61615)
- [https://go.dev/cl/514896](https://go.dev/cl/514896)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2023-1988) and the [Go
Vulnerability Database](https://togithub.com/golang/vulndb) ([CC-BY
4.0](https://togithub.com/golang/vulndb#license)).
</details>

---

### swift-nio-http2 vulnerable to HTTP/2 Stream Cancellation Attack
[CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) /
[GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)

<details>
<summary>More information</summary>

#### Details
swift-nio-http2 is vulnerable to a denial-of-service vulnerability in
which a malicious client can create and then reset a large number of
HTTP/2 streams in a short period of time. This causes swift-nio-http2 to
commit to a large amount of expensive work which it then throws away,
including creating entirely new `Channel`s to serve the traffic. This
can easily overwhelm an `EventLoop` and prevent it from making forward
progress.

swift-nio-http2 1.28 contains a remediation for this issue that applies
reset counter using a sliding window. This constrains the number of
stream resets that may occur in a given window of time. Clients
violating this limit will have their connections torn down. This allows
clients to continue to cancel streams for legitimate reasons, while
constraining malicious actors.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

#### References
-
[https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf](https://togithub.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf)
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487)
-
[https://github.com/Azure/AKS/issues/3947](https://togithub.com/Azure/AKS/issues/3947)
-
[https://github.com/akka/akka-http/issues/4323](https://togithub.com/akka/akka-http/issues/4323)
-
[https://github.com/alibaba/tengine/issues/1872](https://togithub.com/alibaba/tengine/issues/1872)
-
[https://github.com/apache/apisix/issues/10320](https://togithub.com/apache/apisix/issues/10320)
-
[https://github.com/caddyserver/caddy/issues/5877](https://togithub.com/caddyserver/caddy/issues/5877)
-
[https://github.com/dotnet/announcements/issues/277](https://togithub.com/dotnet/announcements/issues/277)
-
[https://github.com/eclipse/jetty.project/issues/10679](https://togithub.com/eclipse/jetty.project/issues/10679)
-
[https://github.com/etcd-io/etcd/issues/16740](https://togithub.com/etcd-io/etcd/issues/16740)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
-
[https://github.com/haproxy/haproxy/issues/2312](https://togithub.com/haproxy/haproxy/issues/2312)
-
[https://github.com/hyperium/hyper/issues/3337](https://togithub.com/hyperium/hyper/issues/3337)
-
[https://github.com/junkurihara/rust-rpxy/issues/97](https://togithub.com/junkurihara/rust-rpxy/issues/97)
-
[https://github.com/kazu-yamamoto/http2/issues/93](https://togithub.com/kazu-yamamoto/http2/issues/93)
-
[https://github.com/ninenines/cowboy/issues/1615](https://togithub.com/ninenines/cowboy/issues/1615)
-
[https://github.com/openresty/openresty/issues/930](https://togithub.com/openresty/openresty/issues/930)
-
[https://github.com/opensearch-project/data-prepper/issues/3474](https://togithub.com/opensearch-project/data-prepper/issues/3474)
-
[https://github.com/tempesta-tech/tempesta/issues/1986](https://togithub.com/tempesta-tech/tempesta/issues/1986)
-
[https://github.com/varnishcache/varnish-cache/issues/3996](https://togithub.com/varnishcache/varnish-cache/issues/3996)
-
[https://github.com/apache/httpd-site/pull/10](https://togithub.com/apache/httpd-site/pull/10)
-
[https://github.com/apache/trafficserver/pull/10564](https://togithub.com/apache/trafficserver/pull/10564)
-
[https://github.com/envoyproxy/envoy/pull/30055](https://togithub.com/envoyproxy/envoy/pull/30055)
-
[https://github.com/facebook/proxygen/pull/466](https://togithub.com/facebook/proxygen/pull/466)
-
[https://github.com/grpc/grpc-go/pull/6703](https://togithub.com/grpc/grpc-go/pull/6703)
-
[https://github.com/h2o/h2o/pull/3291](https://togithub.com/h2o/h2o/pull/3291)
-
[https://github.com/kubernetes/kubernetes/pull/121120](https://togithub.com/kubernetes/kubernetes/pull/121120)
-
[https://github.com/line/armeria/pull/5232](https://togithub.com/line/armeria/pull/5232)
-
[https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632](https://togithub.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632)
-
[https://github.com/microsoft/CBL-Mariner/pull/6381](https://togithub.com/microsoft/CBL-Mariner/pull/6381)
-
[https://github.com/nghttp2/nghttp2/pull/1961](https://togithub.com/nghttp2/nghttp2/pull/1961)
-
[https://github.com/nodejs/node/pull/50121](https://togithub.com/nodejs/node/pull/50121)
-
[https://github.com/projectcontour/contour/pull/5826](https://togithub.com/projectcontour/contour/pull/5826)
-
[https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1](https://togithub.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1)
-
[https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61](https://togithub.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61)
-
[https://access.redhat.com/security/cve/cve-2023-44487](https://access.redhat.com/security/cve/cve-2023-44487)
-
[https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/](https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/)
-
[https://aws.amazon.com/security/security-bulletins/AWS-2023-011/](https://aws.amazon.com/security/security-bulletins/AWS-2023-011/)
-
[https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/](https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/)
-
[https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/](https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/)
-
[https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/](https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/)
-
[https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack](https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack)
-
[https://blog.vespa.ai/cve-2023-44487/](https://blog.vespa.ai/cve-2023-44487/)
-
[https://bugzilla.proxmox.com/show_bug.cgi?id=4988](https://bugzilla.proxmox.com/show_bug.cgi?id=4988)
-
[https://bugzilla.redhat.com/show_bug.cgi?id=2242803](https://bugzilla.redhat.com/show_bug.cgi?id=2242803)
-
[https://bugzilla.suse.com/show_bug.cgi?id=1216123](https://bugzilla.suse.com/show_bug.cgi?id=1216123)
-
[https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9](https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9)
-
[https://chaos.social/@&#8203;icing/111210915918780532](https://chaos.social/@&#8203;icing/111210915918780532)
-
[https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/](https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/)
-
[https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack](https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack)
-
[https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125](https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125)
-
[https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve](https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve)
-
[https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764](https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764)
-
[https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088](https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088)
-
[https://github.com/Kong/kong/discussions/11741](https://togithub.com/Kong/kong/discussions/11741)
-
[https://github.com/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/advisories/GHSA-vx74-f528-fxqg](https://togithub.com/advisories/GHSA-vx74-f528-fxqg)
-
[https://github.com/advisories/GHSA-xpw8-rcwv-8f8p](https://togithub.com/advisories/GHSA-xpw8-rcwv-8f8p)
-
[https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113](https://togithub.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113)
-
[https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2](https://togithub.com/apache/tomcat/tree/main/java/org/apache/coyote/http2)
-
[https://github.com/apple/swift-nio-http2](https://togithub.com/apple/swift-nio-http2)
-
[https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487](https://togithub.com/arkrwn/PoC/tree/main/CVE-2023-44487)
-
[https://github.com/bcdannyboy/CVE-2023-44487](https://togithub.com/bcdannyboy/CVE-2023-44487)
-
[https://github.com/caddyserver/caddy/releases/tag/v2.7.5](https://togithub.com/caddyserver/caddy/releases/tag/v2.7.5)
-
[https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73](https://togithub.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73)
-
[https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244](https://togithub.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244)
-
[https://github.com/micrictor/http2-rst-stream](https://togithub.com/micrictor/http2-rst-stream)
-
[https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0](https://togithub.com/nghttp2/nghttp2/releases/tag/v1.57.0)
-
[https://github.com/oqtane/oqtane.framework/discussions/3367](https://togithub.com/oqtane/oqtane.framework/discussions/3367)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://istio.io/latest/news/security/istio-security-2023-004/](https://istio.io/latest/news/security/istio-security-2023-004/)
-
[https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/](https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/)
-
[https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q](https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/)
-
[https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html](https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html)
-
[https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html](https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html)
-
[https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html](https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html)
-
[https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/](https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/)
-
[https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487)
-
[https://my.f5.com/manage/s/article/K000137106](https://my.f5.com/manage/s/article/K000137106)
-
[https://netty.io/news/2023/10/10/4-1-100-Final.html](https://netty.io/news/2023/10/10/4-1-100-Final.html)
-
[https://news.ycombinator.com/item?id=37830987](https://news.ycombinator.com/item?id=37830987)
-
[https://news.ycombinator.com/item?id=37830998](https://news.ycombinator.com/item?id=37830998)
-
[https://news.ycombinator.com/item?id=37831062](https://news.ycombinator.com/item?id=37831062)
-
[https://news.ycombinator.com/item?id=37837043](https://news.ycombinator.com/item?id=37837043)
-
[https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/](https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/)
-
[https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected](https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected)
-
[https://security.netapp.com/advisory/ntap-20231016-0001/](https://security.netapp.com/advisory/ntap-20231016-0001/)
-
[https://security.paloaltonetworks.com/CVE-2023-44487](https://security.paloaltonetworks.com/CVE-2023-44487)
-
[https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14](https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14)
-
[https://ubuntu.com/security/CVE-2023-44487](https://ubuntu.com/security/CVE-2023-44487)
-
[https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/](https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/)
-
[https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487](https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487)
-
[https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event](https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event)
-
[https://www.debian.org/security/2023/dsa-5521](https://www.debian.org/security/2023/dsa-5521)
-
[https://www.debian.org/security/2023/dsa-5522](https://www.debian.org/security/2023/dsa-5522)
-
[https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487](https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487)
-
[https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/](https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/)
-
[https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/](https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/)
-
[https://www.openwall.com/lists/oss-security/2023/10/10/6](https://www.openwall.com/lists/oss-security/2023/10/10/6)
-
[https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack](https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack)
-
[https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/](https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/4](http://www.openwall.com/lists/oss-security/2023/10/13/4)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/9](http://www.openwall.com/lists/oss-security/2023/10/13/9)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-qppj-fm5r-hxr3) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### HTTP/2 rapid reset can cause excessive work in net/http
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
Moderate

#### References
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://pkg.go.dev/vuln/GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)
- [golang.org/x/net](golang.org/x/net)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-4374-p667-p6c8) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### HTTP/2 rapid reset can cause excessive work in net/http
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)
/ [GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
Unknown

#### References
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2023-2102) and the [Go
Vulnerability Database](https://togithub.com/golang/vulndb) ([CC-BY
4.0](https://togithub.com/golang/vulndb#license)).
</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/grafana/loki).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy44LjEiLCJ1cGRhdGVkSW5WZXIiOiIzNy4xOS4yIiwidGFyZ2V0QnJhbmNoIjoicmVsZWFzZS0yLjgueCJ9-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@monkeyDluffy6017
Copy link
Contributor

considered resolved

mend-for-github-com bot referenced this issue in DelineaXPM/dsv-k8s Jan 10, 2024
@mend-for-github-com
chore(deps): update ⬆️ gomod to v0.17.0 (#112)
32db48f 
This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| golang.org/x/net | `v0.13.0` -> `v0.17.0` |
[![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fnet/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/go/golang.org%2fx%2fnet/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/go/golang.org%2fx%2fnet/v0.13.0/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fnet/v0.13.0/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

#### [CVE-2023-39325](https://togithub.com/golang/go/issues/63417)

A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

####
[CVE-2023-44487](https://togithub.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3)

## HTTP/2 Rapid reset attack
The HTTP/2 protocol allows clients to indicate to the server that a
previous stream should be canceled by sending a RST_STREAM frame. The
protocol does not require the client and server to coordinate the
cancellation in any way, the client may do it unilaterally. The client
may also assume that the cancellation will take effect immediately when
the server receives the RST_STREAM frame, before any other data from
that TCP connection is processed.

Abuse of this feature is called a Rapid Reset attack because it relies
on the ability for an endpoint to send a RST_STREAM frame immediately
after sending a request frame, which makes the other endpoint start
working and then rapidly resets the request. The request is canceled,
but leaves the HTTP/2 connection open.

The HTTP/2 Rapid Reset attack built on this capability is simple: The
client opens a large number of streams at once as in the standard HTTP/2
attack, but rather than waiting for a response to each request stream
from the server or proxy, the client cancels each request immediately.

The ability to reset streams immediately allows each connection to have
an indefinite number of requests in flight. By explicitly canceling the
requests, the attacker never exceeds the limit on the number of
concurrent open streams. The number of in-flight requests is no longer
dependent on the round-trip time (RTT), but only on the available
network bandwidth.

In a typical HTTP/2 server implementation, the server will still have to
do significant amounts of work for canceled requests, such as allocating
new stream data structures, parsing the query and doing header
decompression, and mapping the URL to a resource. For reverse proxy
implementations, the request may be proxied to the backend server before
the RST_STREAM frame is processed. The client on the other hand paid
almost no costs for sending the requests. This creates an exploitable
cost asymmetry between the server and the client.

Multiple software artifacts implementing HTTP/2 are affected. This
advisory was originally ingested from the `swift-nio-http2` repo
advisory and their original conent follows.

## swift-nio-http2 specific advisory
swift-nio-http2 is vulnerable to a denial-of-service vulnerability in
which a malicious client can create and then reset a large number of
HTTP/2 streams in a short period of time. This causes swift-nio-http2 to
commit to a large amount of expensive work which it then throws away,
including creating entirely new `Channel`s to serve the traffic. This
can easily overwhelm an `EventLoop` and prevent it from making forward
progress.

swift-nio-http2 1.28 contains a remediation for this issue that applies
reset counter using a sliding window. This constrains the number of
stream resets that may occur in a given window of time. Clients
violating this limit will have their connections torn down. This allows
clients to continue to cancel streams for legitimate reasons, while
constraining malicious actors.

---

### HTTP/2 rapid reset can cause excessive work in net/http
BIT-golang-2023-39325 /
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)
/ [GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
- CVSS Score: 7.5 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

#### References
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/)
-
[https://pkg.go.dev/vuln/GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)
-
[https://security.gentoo.org/glsa/202311-09](https://security.gentoo.org/glsa/202311-09)
-
[https://security.netapp.com/advisory/ntap-20231110-0008/](https://security.netapp.com/advisory/ntap-20231110-0008/)
- [golang.org/x/net](golang.org/x/net)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-4374-p667-p6c8) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### HTTP/2 rapid reset can cause excessive work in net/http
BIT-golang-2023-39325 /
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)
/ [GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
Unknown

#### References
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2023-2102) and the [Go
Vulnerability Database](https://togithub.com/golang/vulndb) ([CC-BY
4.0](https://togithub.com/golang/vulndb#license)).
</details>

---

### HTTP/2 Stream Cancellation Attack
BIT-apisix-2023-44487 / BIT-aspnet-core-2023-44487 /
BIT-contour-2023-44487 / BIT-dotnet-2023-44487 /
BIT-dotnet-sdk-2023-44487 / BIT-envoy-2023-44487 / BIT-golang-2023-44487
/ BIT-jenkins-2023-44487 / BIT-kong-2023-44487 / BIT-nginx-2023-44487 /
BIT-nginx-ingress-controller-2023-44487 / BIT-node-2023-44487 /
BIT-solr-2023-44487 / BIT-tomcat-2023-44487 / BIT-varnish-2023-44487 /
[CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) /
[GHSA-2m7v-gc89-fjqf](https://togithub.com/advisories/GHSA-2m7v-gc89-fjqf)
/
[GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)
/
[GHSA-vx74-f528-fxqg](https://togithub.com/advisories/GHSA-vx74-f528-fxqg)
/
[GHSA-xpw8-rcwv-8f8p](https://togithub.com/advisories/GHSA-xpw8-rcwv-8f8p)

<details>
<summary>More information</summary>

#### Details
##### HTTP/2 Rapid reset attack
The HTTP/2 protocol allows clients to indicate to the server that a
previous stream should be canceled by sending a RST_STREAM frame. The
protocol does not require the client and server to coordinate the
cancellation in any way, the client may do it unilaterally. The client
may also assume that the cancellation will take effect immediately when
the server receives the RST_STREAM frame, before any other data from
that TCP connection is processed.

Abuse of this feature is called a Rapid Reset attack because it relies
on the ability for an endpoint to send a RST_STREAM frame immediately
after sending a request frame, which makes the other endpoint start
working and then rapidly resets the request. The request is canceled,
but leaves the HTTP/2 connection open.

The HTTP/2 Rapid Reset attack built on this capability is simple: The
client opens a large number of streams at once as in the standard HTTP/2
attack, but rather than waiting for a response to each request stream
from the server or proxy, the client cancels each request immediately.

The ability to reset streams immediately allows each connection to have
an indefinite number of requests in flight. By explicitly canceling the
requests, the attacker never exceeds the limit on the number of
concurrent open streams. The number of in-flight requests is no longer
dependent on the round-trip time (RTT), but only on the available
network bandwidth.

In a typical HTTP/2 server implementation, the server will still have to
do significant amounts of work for canceled requests, such as allocating
new stream data structures, parsing the query and doing header
decompression, and mapping the URL to a resource. For reverse proxy
implementations, the request may be proxied to the backend server before
the RST_STREAM frame is processed. The client on the other hand paid
almost no costs for sending the requests. This creates an exploitable
cost asymmetry between the server and the client.

Multiple software artifacts implementing HTTP/2 are affected. This
advisory was originally ingested from the `swift-nio-http2` repo
advisory and their original conent follows.

##### swift-nio-http2 specific advisory
swift-nio-http2 is vulnerable to a denial-of-service vulnerability in
which a malicious client can create and then reset a large number of
HTTP/2 streams in a short period of time. This causes swift-nio-http2 to
commit to a large amount of expensive work which it then throws away,
including creating entirely new `Channel`s to serve the traffic. This
can easily overwhelm an `EventLoop` and prevent it from making forward
progress.

swift-nio-http2 1.28 contains a remediation for this issue that applies
reset counter using a sliding window. This constrains the number of
stream resets that may occur in a given window of time. Clients
violating this limit will have their connections torn down. This allows
clients to continue to cancel streams for legitimate reasons, while
constraining malicious actors.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

#### References
-
[https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf](https://togithub.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf)
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487)
-
[https://github.com/Azure/AKS/issues/3947](https://togithub.com/Azure/AKS/issues/3947)
-
[https://github.com/akka/akka-http/issues/4323](https://togithub.com/akka/akka-http/issues/4323)
-
[https://github.com/alibaba/tengine/issues/1872](https://togithub.com/alibaba/tengine/issues/1872)
-
[https://github.com/apache/apisix/issues/10320](https://togithub.com/apache/apisix/issues/10320)
-
[https://github.com/caddyserver/caddy/issues/5877](https://togithub.com/caddyserver/caddy/issues/5877)
-
[https://github.com/dotnet/announcements/issues/277](https://togithub.com/dotnet/announcements/issues/277)
-
[https://github.com/eclipse/jetty.project/issues/10679](https://togithub.com/eclipse/jetty.project/issues/10679)
-
[https://github.com/etcd-io/etcd/issues/16740](https://togithub.com/etcd-io/etcd/issues/16740)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
-
[https://github.com/haproxy/haproxy/issues/2312](https://togithub.com/haproxy/haproxy/issues/2312)
-
[https://github.com/hyperium/hyper/issues/3337](https://togithub.com/hyperium/hyper/issues/3337)
-
[https://github.com/junkurihara/rust-rpxy/issues/97](https://togithub.com/junkurihara/rust-rpxy/issues/97)
-
[https://github.com/kazu-yamamoto/http2/issues/93](https://togithub.com/kazu-yamamoto/http2/issues/93)
-
[https://github.com/ninenines/cowboy/issues/1615](https://togithub.com/ninenines/cowboy/issues/1615)
-
[https://github.com/openresty/openresty/issues/930](https://togithub.com/openresty/openresty/issues/930)
-
[https://github.com/opensearch-project/data-prepper/issues/3474](https://togithub.com/opensearch-project/data-prepper/issues/3474)
-
[https://github.com/tempesta-tech/tempesta/issues/1986](https://togithub.com/tempesta-tech/tempesta/issues/1986)
-
[https://github.com/varnishcache/varnish-cache/issues/3996](https://togithub.com/varnishcache/varnish-cache/issues/3996)
-
[https://github.com/apache/httpd-site/pull/10](https://togithub.com/apache/httpd-site/pull/10)
-
[https://github.com/apache/trafficserver/pull/10564](https://togithub.com/apache/trafficserver/pull/10564)
-
[https://github.com/envoyproxy/envoy/pull/30055](https://togithub.com/envoyproxy/envoy/pull/30055)
-
[https://github.com/facebook/proxygen/pull/466](https://togithub.com/facebook/proxygen/pull/466)
-
[https://github.com/grpc/grpc-go/pull/6703](https://togithub.com/grpc/grpc-go/pull/6703)
-
[https://github.com/h2o/h2o/pull/3291](https://togithub.com/h2o/h2o/pull/3291)
-
[https://github.com/kubernetes/kubernetes/pull/121120](https://togithub.com/kubernetes/kubernetes/pull/121120)
-
[https://github.com/line/armeria/pull/5232](https://togithub.com/line/armeria/pull/5232)
-
[https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632](https://togithub.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632)
-
[https://github.com/microsoft/CBL-Mariner/pull/6381](https://togithub.com/microsoft/CBL-Mariner/pull/6381)
-
[https://github.com/nghttp2/nghttp2/pull/1961](https://togithub.com/nghttp2/nghttp2/pull/1961)
-
[https://github.com/nodejs/node/pull/50121](https://togithub.com/nodejs/node/pull/50121)
-
[https://github.com/projectcontour/contour/pull/5826](https://togithub.com/projectcontour/contour/pull/5826)
-
[https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1](https://togithub.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1)
-
[https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61](https://togithub.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61)
-
[https://access.redhat.com/security/cve/cve-2023-44487](https://access.redhat.com/security/cve/cve-2023-44487)
-
[https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/](https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/)
-
[https://aws.amazon.com/security/security-bulletins/AWS-2023-011/](https://aws.amazon.com/security/security-bulletins/AWS-2023-011/)
-
[https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/](https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/)
-
[https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/](https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/)
-
[https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/](https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/)
-
[https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack](https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack)
-
[https://blog.vespa.ai/cve-2023-44487/](https://blog.vespa.ai/cve-2023-44487/)
-
[https://bugzilla.proxmox.com/show_bug.cgi?id=4988](https://bugzilla.proxmox.com/show_bug.cgi?id=4988)
-
[https://bugzilla.redhat.com/show_bug.cgi?id=2242803](https://bugzilla.redhat.com/show_bug.cgi?id=2242803)
-
[https://bugzilla.suse.com/show_bug.cgi?id=1216123](https://bugzilla.suse.com/show_bug.cgi?id=1216123)
-
[https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9](https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9)
-
[https://chaos.social/@&#8203;icing/111210915918780532](https://chaos.social/@&#8203;icing/111210915918780532)
-
[https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/](https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/)
-
[https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack](https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack)
-
[https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125](https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125)
-
[https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715](https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715)
-
[https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve](https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve)
-
[https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764](https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764)
-
[https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088](https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088)
-
[https://github.com/Kong/kong/discussions/11741](https://togithub.com/Kong/kong/discussions/11741)
-
[https://github.com/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/advisories/GHSA-vx74-f528-fxqg](https://togithub.com/advisories/GHSA-vx74-f528-fxqg)
-
[https://github.com/advisories/GHSA-xpw8-rcwv-8f8p](https://togithub.com/advisories/GHSA-xpw8-rcwv-8f8p)
-
[https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113](https://togithub.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113)
-
[https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2](https://togithub.com/apache/tomcat/tree/main/java/org/apache/coyote/http2)
-
[https://github.com/apple/swift-nio-http2](https://togithub.com/apple/swift-nio-http2)
-
[https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487](https://togithub.com/arkrwn/PoC/tree/main/CVE-2023-44487)
-
[https://github.com/bcdannyboy/CVE-2023-44487](https://togithub.com/bcdannyboy/CVE-2023-44487)
-
[https://github.com/caddyserver/caddy/releases/tag/v2.7.5](https://togithub.com/caddyserver/caddy/releases/tag/v2.7.5)
-
[https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73](https://togithub.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73)
-
[https://github.com/grpc/grpc-go/releases](https://togithub.com/grpc/grpc-go/releases)
-
[https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244](https://togithub.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244)
-
[https://github.com/micrictor/http2-rst-stream](https://togithub.com/micrictor/http2-rst-stream)
-
[https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0](https://togithub.com/nghttp2/nghttp2/releases/tag/v1.57.0)
-
[https://github.com/oqtane/oqtane.framework/discussions/3367](https://togithub.com/oqtane/oqtane.framework/discussions/3367)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://istio.io/latest/news/security/istio-security-2023-004/](https://istio.io/latest/news/security/istio-security-2023-004/)
-
[https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/](https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/)
-
[https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q](https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html)
-
[https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html](https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html)
-
[https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html](https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/)
-
[https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html](https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html)
-
[https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html](https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html)
-
[https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html](https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html)
-
[https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/](https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/)
-
[https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487)
-
[https://my.f5.com/manage/s/article/K000137106](https://my.f5.com/manage/s/article/K000137106)
-
[https://netty.io/news/2023/10/10/4-1-100-Final.html](https://netty.io/news/2023/10/10/4-1-100-Final.html)
-
[https://news.ycombinator.com/item?id=37830987](https://news.ycombinator.com/item?id=37830987)
-
[https://news.ycombinator.com/item?id=37830998](https://news.ycombinator.com/item?id=37830998)
-
[https://news.ycombinator.com/item?id=37831062](https://news.ycombinator.com/item?id=37831062)
-
[https://news.ycombinator.com/item?id=37837043](https://news.ycombinator.com/item?id=37837043)
-
[https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/](https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/)
-
[https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected](https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected)
-
[https://security.gentoo.org/glsa/202311-09](https://security.gentoo.org/glsa/202311-09)
-
[https://security.netapp.com/advisory/ntap-20231016-0001/](https://security.netapp.com/advisory/ntap-20231016-0001/)
-
[https://security.paloaltonetworks.com/CVE-2023-44487](https://security.paloaltonetworks.com/CVE-2023-44487)
-
[https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14](https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14)
-
[https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12](https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12)
-
[https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94](https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94)
-
[https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81](https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81)
-
[https://ubuntu.com/security/CVE-2023-44487](https://ubuntu.com/security/CVE-2023-44487)
-
[https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/](https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/)
-
[https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487](https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487)
-
[https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event](https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event)
-
[https://www.debian.org/security/2023/dsa-5521](https://www.debian.org/security/2023/dsa-5521)
-
[https://www.debian.org/security/2023/dsa-5522](https://www.debian.org/security/2023/dsa-5522)
-
[https://www.debian.org/security/2023/dsa-5540](https://www.debian.org/security/2023/dsa-5540)
-
[https://www.debian.org/security/2023/dsa-5549](https://www.debian.org/security/2023/dsa-5549)
-
[https://www.debian.org/security/2023/dsa-5558](https://www.debian.org/security/2023/dsa-5558)
-
[https://www.debian.org/security/2023/dsa-5570](https://www.debian.org/security/2023/dsa-5570)
-
[https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487](https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487)
-
[https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/](https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/)
-
[https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/](https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/)
-
[https://www.openwall.com/lists/oss-security/2023/10/10/6](https://www.openwall.com/lists/oss-security/2023/10/10/6)
-
[https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack](https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack)
-
[https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/](https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/4](http://www.openwall.com/lists/oss-security/2023/10/13/4)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/9](http://www.openwall.com/lists/oss-security/2023/10/13/9)
-
[http://www.openwall.com/lists/oss-security/2023/10/18/4](http://www.openwall.com/lists/oss-security/2023/10/18/4)
-
[http://www.openwall.com/lists/oss-security/2023/10/18/8](http://www.openwall.com/lists/oss-security/2023/10/18/8)
-
[http://www.openwall.com/lists/oss-security/2023/10/19/6](http://www.openwall.com/lists/oss-security/2023/10/19/6)
-
[http://www.openwall.com/lists/oss-security/2023/10/20/8](http://www.openwall.com/lists/oss-security/2023/10/20/8)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-qppj-fm5r-hxr3) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy41Mi4wIiwidXBkYXRlZEluVmVyIjoiMzcuMTA4LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIn0=-->

Co-authored-by: mend-for-github-com[bot] <50673670+mend-for-github-com[bot]@users.noreply.github.com>
mend-for-github-com bot referenced this issue in DelineaXPM/dsv-k8s-sidecar Jan 15, 2024
@mend-for-github-com
chore(deps): update ⬆️ gomod to v0.17.0 (#51)
c0226fe 
This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| golang.org/x/net | `v0.13.0` -> `v0.17.0` |
[![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fnet/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/go/golang.org%2fx%2fnet/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/go/golang.org%2fx%2fnet/v0.13.0/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fnet/v0.13.0/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

#### [CVE-2023-39325](https://togithub.com/golang/go/issues/63417)

A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

####
[CVE-2023-44487](https://togithub.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3)

## HTTP/2 Rapid reset attack
The HTTP/2 protocol allows clients to indicate to the server that a
previous stream should be canceled by sending a RST_STREAM frame. The
protocol does not require the client and server to coordinate the
cancellation in any way, the client may do it unilaterally. The client
may also assume that the cancellation will take effect immediately when
the server receives the RST_STREAM frame, before any other data from
that TCP connection is processed.

Abuse of this feature is called a Rapid Reset attack because it relies
on the ability for an endpoint to send a RST_STREAM frame immediately
after sending a request frame, which makes the other endpoint start
working and then rapidly resets the request. The request is canceled,
but leaves the HTTP/2 connection open.

The HTTP/2 Rapid Reset attack built on this capability is simple: The
client opens a large number of streams at once as in the standard HTTP/2
attack, but rather than waiting for a response to each request stream
from the server or proxy, the client cancels each request immediately.

The ability to reset streams immediately allows each connection to have
an indefinite number of requests in flight. By explicitly canceling the
requests, the attacker never exceeds the limit on the number of
concurrent open streams. The number of in-flight requests is no longer
dependent on the round-trip time (RTT), but only on the available
network bandwidth.

In a typical HTTP/2 server implementation, the server will still have to
do significant amounts of work for canceled requests, such as allocating
new stream data structures, parsing the query and doing header
decompression, and mapping the URL to a resource. For reverse proxy
implementations, the request may be proxied to the backend server before
the RST_STREAM frame is processed. The client on the other hand paid
almost no costs for sending the requests. This creates an exploitable
cost asymmetry between the server and the client.

Multiple software artifacts implementing HTTP/2 are affected. This
advisory was originally ingested from the `swift-nio-http2` repo
advisory and their original conent follows.

## swift-nio-http2 specific advisory
swift-nio-http2 is vulnerable to a denial-of-service vulnerability in
which a malicious client can create and then reset a large number of
HTTP/2 streams in a short period of time. This causes swift-nio-http2 to
commit to a large amount of expensive work which it then throws away,
including creating entirely new `Channel`s to serve the traffic. This
can easily overwhelm an `EventLoop` and prevent it from making forward
progress.

swift-nio-http2 1.28 contains a remediation for this issue that applies
reset counter using a sliding window. This constrains the number of
stream resets that may occur in a given window of time. Clients
violating this limit will have their connections torn down. This allows
clients to continue to cancel streams for legitimate reasons, while
constraining malicious actors.

---

### HTTP/2 rapid reset can cause excessive work in net/http
BIT-golang-2023-39325 /
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)
/ [GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
Unknown

#### References
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2023-2102) and the [Go
Vulnerability Database](https://togithub.com/golang/vulndb) ([CC-BY
4.0](https://togithub.com/golang/vulndb#license)).
</details>

---

### HTTP/2 Stream Cancellation Attack
BIT-apisix-2023-44487 / BIT-aspnet-core-2023-44487 /
BIT-contour-2023-44487 / BIT-dotnet-2023-44487 /
BIT-dotnet-sdk-2023-44487 / BIT-envoy-2023-44487 / BIT-golang-2023-44487
/ BIT-jenkins-2023-44487 / BIT-kong-2023-44487 / BIT-nginx-2023-44487 /
BIT-nginx-ingress-controller-2023-44487 / BIT-node-2023-44487 /
BIT-solr-2023-44487 / BIT-tomcat-2023-44487 / BIT-varnish-2023-44487 /
[CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) /
[GHSA-2m7v-gc89-fjqf](https://togithub.com/advisories/GHSA-2m7v-gc89-fjqf)
/
[GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)
/
[GHSA-vx74-f528-fxqg](https://togithub.com/advisories/GHSA-vx74-f528-fxqg)
/
[GHSA-xpw8-rcwv-8f8p](https://togithub.com/advisories/GHSA-xpw8-rcwv-8f8p)

<details>
<summary>More information</summary>

#### Details
##### HTTP/2 Rapid reset attack
The HTTP/2 protocol allows clients to indicate to the server that a
previous stream should be canceled by sending a RST_STREAM frame. The
protocol does not require the client and server to coordinate the
cancellation in any way, the client may do it unilaterally. The client
may also assume that the cancellation will take effect immediately when
the server receives the RST_STREAM frame, before any other data from
that TCP connection is processed.

Abuse of this feature is called a Rapid Reset attack because it relies
on the ability for an endpoint to send a RST_STREAM frame immediately
after sending a request frame, which makes the other endpoint start
working and then rapidly resets the request. The request is canceled,
but leaves the HTTP/2 connection open.

The HTTP/2 Rapid Reset attack built on this capability is simple: The
client opens a large number of streams at once as in the standard HTTP/2
attack, but rather than waiting for a response to each request stream
from the server or proxy, the client cancels each request immediately.

The ability to reset streams immediately allows each connection to have
an indefinite number of requests in flight. By explicitly canceling the
requests, the attacker never exceeds the limit on the number of
concurrent open streams. The number of in-flight requests is no longer
dependent on the round-trip time (RTT), but only on the available
network bandwidth.

In a typical HTTP/2 server implementation, the server will still have to
do significant amounts of work for canceled requests, such as allocating
new stream data structures, parsing the query and doing header
decompression, and mapping the URL to a resource. For reverse proxy
implementations, the request may be proxied to the backend server before
the RST_STREAM frame is processed. The client on the other hand paid
almost no costs for sending the requests. This creates an exploitable
cost asymmetry between the server and the client.

Multiple software artifacts implementing HTTP/2 are affected. This
advisory was originally ingested from the `swift-nio-http2` repo
advisory and their original conent follows.

##### swift-nio-http2 specific advisory
swift-nio-http2 is vulnerable to a denial-of-service vulnerability in
which a malicious client can create and then reset a large number of
HTTP/2 streams in a short period of time. This causes swift-nio-http2 to
commit to a large amount of expensive work which it then throws away,
including creating entirely new `Channel`s to serve the traffic. This
can easily overwhelm an `EventLoop` and prevent it from making forward
progress.

swift-nio-http2 1.28 contains a remediation for this issue that applies
reset counter using a sliding window. This constrains the number of
stream resets that may occur in a given window of time. Clients
violating this limit will have their connections torn down. This allows
clients to continue to cancel streams for legitimate reasons, while
constraining malicious actors.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

#### References
-
[https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf](https://togithub.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf)
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487)
-
[https://github.com/Azure/AKS/issues/3947](https://togithub.com/Azure/AKS/issues/3947)
-
[https://github.com/akka/akka-http/issues/4323](https://togithub.com/akka/akka-http/issues/4323)
-
[https://github.com/alibaba/tengine/issues/1872](https://togithub.com/alibaba/tengine/issues/1872)
-
[https://github.com/apache/apisix/issues/10320](https://togithub.com/apache/apisix/issues/10320)
-
[https://github.com/caddyserver/caddy/issues/5877](https://togithub.com/caddyserver/caddy/issues/5877)
-
[https://github.com/dotnet/announcements/issues/277](https://togithub.com/dotnet/announcements/issues/277)
-
[https://github.com/eclipse/jetty.project/issues/10679](https://togithub.com/eclipse/jetty.project/issues/10679)
-
[https://github.com/etcd-io/etcd/issues/16740](https://togithub.com/etcd-io/etcd/issues/16740)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
-
[https://github.com/haproxy/haproxy/issues/2312](https://togithub.com/haproxy/haproxy/issues/2312)
-
[https://github.com/hyperium/hyper/issues/3337](https://togithub.com/hyperium/hyper/issues/3337)
-
[https://github.com/junkurihara/rust-rpxy/issues/97](https://togithub.com/junkurihara/rust-rpxy/issues/97)
-
[https://github.com/kazu-yamamoto/http2/issues/93](https://togithub.com/kazu-yamamoto/http2/issues/93)
-
[https://github.com/ninenines/cowboy/issues/1615](https://togithub.com/ninenines/cowboy/issues/1615)
-
[https://github.com/openresty/openresty/issues/930](https://togithub.com/openresty/openresty/issues/930)
-
[https://github.com/opensearch-project/data-prepper/issues/3474](https://togithub.com/opensearch-project/data-prepper/issues/3474)
-
[https://github.com/tempesta-tech/tempesta/issues/1986](https://togithub.com/tempesta-tech/tempesta/issues/1986)
-
[https://github.com/varnishcache/varnish-cache/issues/3996](https://togithub.com/varnishcache/varnish-cache/issues/3996)
-
[https://github.com/apache/httpd-site/pull/10](https://togithub.com/apache/httpd-site/pull/10)
-
[https://github.com/apache/trafficserver/pull/10564](https://togithub.com/apache/trafficserver/pull/10564)
-
[https://github.com/envoyproxy/envoy/pull/30055](https://togithub.com/envoyproxy/envoy/pull/30055)
-
[https://github.com/facebook/proxygen/pull/466](https://togithub.com/facebook/proxygen/pull/466)
-
[https://github.com/grpc/grpc-go/pull/6703](https://togithub.com/grpc/grpc-go/pull/6703)
-
[https://github.com/h2o/h2o/pull/3291](https://togithub.com/h2o/h2o/pull/3291)
-
[https://github.com/kubernetes/kubernetes/pull/121120](https://togithub.com/kubernetes/kubernetes/pull/121120)
-
[https://github.com/line/armeria/pull/5232](https://togithub.com/line/armeria/pull/5232)
-
[https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632](https://togithub.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632)
-
[https://github.com/microsoft/CBL-Mariner/pull/6381](https://togithub.com/microsoft/CBL-Mariner/pull/6381)
-
[https://github.com/nghttp2/nghttp2/pull/1961](https://togithub.com/nghttp2/nghttp2/pull/1961)
-
[https://github.com/nodejs/node/pull/50121](https://togithub.com/nodejs/node/pull/50121)
-
[https://github.com/projectcontour/contour/pull/5826](https://togithub.com/projectcontour/contour/pull/5826)
-
[https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1](https://togithub.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1)
-
[https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61](https://togithub.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61)
-
[https://access.redhat.com/security/cve/cve-2023-44487](https://access.redhat.com/security/cve/cve-2023-44487)
-
[https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/](https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/)
-
[https://aws.amazon.com/security/security-bulletins/AWS-2023-011/](https://aws.amazon.com/security/security-bulletins/AWS-2023-011/)
-
[https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/](https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/)
-
[https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/](https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/)
-
[https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/](https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/)
-
[https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack](https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack)
-
[https://blog.vespa.ai/cve-2023-44487/](https://blog.vespa.ai/cve-2023-44487/)
-
[https://bugzilla.proxmox.com/show_bug.cgi?id=4988](https://bugzilla.proxmox.com/show_bug.cgi?id=4988)
-
[https://bugzilla.redhat.com/show_bug.cgi?id=2242803](https://bugzilla.redhat.com/show_bug.cgi?id=2242803)
-
[https://bugzilla.suse.com/show_bug.cgi?id=1216123](https://bugzilla.suse.com/show_bug.cgi?id=1216123)
-
[https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9](https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9)
-
[https://chaos.social/@&#8203;icing/111210915918780532](https://chaos.social/@&#8203;icing/111210915918780532)
-
[https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/](https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/)
-
[https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack](https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack)
-
[https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125](https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125)
-
[https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715](https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715)
-
[https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve](https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve)
-
[https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764](https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764)
-
[https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088](https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088)
-
[https://github.com/Kong/kong/discussions/11741](https://togithub.com/Kong/kong/discussions/11741)
-
[https://github.com/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/advisories/GHSA-vx74-f528-fxqg](https://togithub.com/advisories/GHSA-vx74-f528-fxqg)
-
[https://github.com/advisories/GHSA-xpw8-rcwv-8f8p](https://togithub.com/advisories/GHSA-xpw8-rcwv-8f8p)
-
[https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113](https://togithub.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113)
-
[https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2](https://togithub.com/apache/tomcat/tree/main/java/org/apache/coyote/http2)
-
[https://github.com/apple/swift-nio-http2](https://togithub.com/apple/swift-nio-http2)
-
[https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487](https://togithub.com/arkrwn/PoC/tree/main/CVE-2023-44487)
-
[https://github.com/bcdannyboy/CVE-2023-44487](https://togithub.com/bcdannyboy/CVE-2023-44487)
-
[https://github.com/caddyserver/caddy/releases/tag/v2.7.5](https://togithub.com/caddyserver/caddy/releases/tag/v2.7.5)
-
[https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73](https://togithub.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73)
-
[https://github.com/grpc/grpc-go/releases](https://togithub.com/grpc/grpc-go/releases)
-
[https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244](https://togithub.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244)
-
[https://github.com/micrictor/http2-rst-stream](https://togithub.com/micrictor/http2-rst-stream)
-
[https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0](https://togithub.com/nghttp2/nghttp2/releases/tag/v1.57.0)
-
[https://github.com/oqtane/oqtane.framework/discussions/3367](https://togithub.com/oqtane/oqtane.framework/discussions/3367)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://istio.io/latest/news/security/istio-security-2023-004/](https://istio.io/latest/news/security/istio-security-2023-004/)
-
[https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/](https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/)
-
[https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q](https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html)
-
[https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html](https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html)
-
[https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html](https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/)
-
[https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html](https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html)
-
[https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html](https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html)
-
[https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html](https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html)
-
[https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/](https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/)
-
[https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487)
-
[https://my.f5.com/manage/s/article/K000137106](https://my.f5.com/manage/s/article/K000137106)
-
[https://netty.io/news/2023/10/10/4-1-100-Final.html](https://netty.io/news/2023/10/10/4-1-100-Final.html)
-
[https://news.ycombinator.com/item?id=37830987](https://news.ycombinator.com/item?id=37830987)
-
[https://news.ycombinator.com/item?id=37830998](https://news.ycombinator.com/item?id=37830998)
-
[https://news.ycombinator.com/item?id=37831062](https://news.ycombinator.com/item?id=37831062)
-
[https://news.ycombinator.com/item?id=37837043](https://news.ycombinator.com/item?id=37837043)
-
[https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/](https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/)
-
[https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected](https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected)
-
[https://security.gentoo.org/glsa/202311-09](https://security.gentoo.org/glsa/202311-09)
-
[https://security.netapp.com/advisory/ntap-20231016-0001/](https://security.netapp.com/advisory/ntap-20231016-0001/)
-
[https://security.paloaltonetworks.com/CVE-2023-44487](https://security.paloaltonetworks.com/CVE-2023-44487)
-
[https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14](https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14)
-
[https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12](https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12)
-
[https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94](https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94)
-
[https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81](https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81)
-
[https://ubuntu.com/security/CVE-2023-44487](https://ubuntu.com/security/CVE-2023-44487)
-
[https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/](https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/)
-
[https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487](https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487)
-
[https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event](https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event)
-
[https://www.debian.org/security/2023/dsa-5521](https://www.debian.org/security/2023/dsa-5521)
-
[https://www.debian.org/security/2023/dsa-5522](https://www.debian.org/security/2023/dsa-5522)
-
[https://www.debian.org/security/2023/dsa-5540](https://www.debian.org/security/2023/dsa-5540)
-
[https://www.debian.org/security/2023/dsa-5549](https://www.debian.org/security/2023/dsa-5549)
-
[https://www.debian.org/security/2023/dsa-5558](https://www.debian.org/security/2023/dsa-5558)
-
[https://www.debian.org/security/2023/dsa-5570](https://www.debian.org/security/2023/dsa-5570)
-
[https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487](https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487)
-
[https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/](https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/)
-
[https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/](https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/)
-
[https://www.openwall.com/lists/oss-security/2023/10/10/6](https://www.openwall.com/lists/oss-security/2023/10/10/6)
-
[https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack](https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack)
-
[https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/](https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/4](http://www.openwall.com/lists/oss-security/2023/10/13/4)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/9](http://www.openwall.com/lists/oss-security/2023/10/13/9)
-
[http://www.openwall.com/lists/oss-security/2023/10/18/4](http://www.openwall.com/lists/oss-security/2023/10/18/4)
-
[http://www.openwall.com/lists/oss-security/2023/10/18/8](http://www.openwall.com/lists/oss-security/2023/10/18/8)
-
[http://www.openwall.com/lists/oss-security/2023/10/19/6](http://www.openwall.com/lists/oss-security/2023/10/19/6)
-
[http://www.openwall.com/lists/oss-security/2023/10/20/8](http://www.openwall.com/lists/oss-security/2023/10/20/8)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-qppj-fm5r-hxr3) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### HTTP/2 rapid reset can cause excessive work in net/http
BIT-golang-2023-39325 /
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)
/ [GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
- CVSS Score: 7.5 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

#### References
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/)
-
[https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/)
-
[https://pkg.go.dev/vuln/GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)
-
[https://security.gentoo.org/glsa/202311-09](https://security.gentoo.org/glsa/202311-09)
-
[https://security.netapp.com/advisory/ntap-20231110-0008/](https://security.netapp.com/advisory/ntap-20231110-0008/)
- [golang.org/x/net](golang.org/x/net)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-4374-p667-p6c8) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [x] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy41Mi4wIiwidXBkYXRlZEluVmVyIjoiMzcuMTA4LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIn0=-->

Co-authored-by: mend-for-github-com[bot] <50673670+mend-for-github-com[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
Apache APISIX backlog
Archived in project
Milestone
No milestone
Development

No branches or pull requests
3 participants
@monkeyDluffy6017 @purekeeper @moonming