{"id":"GHSA-vx74-f528-fxqg","aliases":[],"url":"https://o3.security/vulnerability/GHSA-vx74-f528-fxqg","summary":"github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset","details":"### Impact\n\nRapidly creating and cancelling streams (HEADERS frame immediately followed by RST_STREAM) without bound cause denial of service.\n\nSee https://www.cve.org/CVERecord?id=CVE-2023-44487 for details.\n\n### Patches\n\nnghttp2 v1.57.0 mitigates this vulnerability by default.\n\n### Workarounds\n\nIf upgrading to nghttp2 v1.57.0 is not possible, implement `nghttp2_on_frame_recv_callback`, and check and count RST_STREAM frames.  If excessive number of RST_STREAM are received, then take action, such as dropping connection silently, or call `nghttp2_submit_goaway` and gracefully terminate the connection.\n\n### References\n\nThe following commit mitigates this vulnerability:\n\n- https://github.com/nghttp2/nghttp2/commit/72b4af6143681f528f1d237b21a9a7aee1738832\n","published":"2023-10-10T18:23:21Z","modified":"2026-02-04T03:53:56.288506Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/nghttp2/nghttp2","fixedVersion":"1.57.0"}],"fix":{"url":"https://github.com/nghttp2/nghttp2/commit/72b4af6143681f528f1d237b21a9a7aee1738832","label":"nghttp2/nghttp2@72b4af6"},"references":[{"type":"WEB","url":"https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg"},{"type":"WEB","url":"https://github.com/nghttp2/nghttp2/commit/72b4af6143681f528f1d237b21a9a7aee1738832"},{"type":"PACKAGE","url":"https://github.com/nghttp2/nghttp2"},{"type":"WEB","url":"https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-02-04T03:53:56.288506Z"}}