{"id":"GHSA-xpw8-rcwv-8f8p","aliases":[],"url":"https://o3.security/vulnerability/GHSA-xpw8-rcwv-8f8p","summary":"io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack","details":"A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack. \n\n### Impact\nThis is a DDOS attack, any http2 server is affected and so you should update as soon as possible.\n\n### Patches\nThis is patched in version 4.1.100.Final.\n\n### Workarounds\nA user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own `Http2FrameListener` implementation or an `ChannelInboundHandler` implementation (depending which http2 API is used).\n\n### References\n- https://www.cve.org/CVERecord?id=CVE-2023-44487\n- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/\n- https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/","published":"2023-10-10T22:22:54Z","modified":"2026-09-10T03:49:58.760787330Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"io.netty:netty-codec-http2","fixedVersion":"4.1.100.Final"}],"fix":{"url":"https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61","label":"netty/netty@58f75f6"},"references":[{"type":"WEB","url":"https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3"},{"type":"WEB","url":"https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487"},{"type":"WEB","url":"https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61"},{"type":"PACKAGE","url":"https://github.com/netty/netty"},{"type":"WEB","url":"https://www.cve.org/CVERecord?id=CVE-2023-44487"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:49:58.760787330Z"}}