Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow HTTP/2 rate control to mitigate HTTP/2 floods (CVE-2023-44487) #10679

Closed
sbordet opened this issue Oct 9, 2023 · 0 comments · Fixed by #10680, #10681 or #10682
Closed

Allow HTTP/2 rate control to mitigate HTTP/2 floods (CVE-2023-44487) #10679

sbordet opened this issue Oct 9, 2023 · 0 comments · Fixed by #10680, #10681 or #10682
Assignees
@sbordet
Labels
Enhancement Security

Comments

@sbordet
Copy link
Contributor

sbordet commented Oct 9, 2023 •
edited by joakime
Loading

Jetty version(s)
10+

Enhancement Description
Review HTTP/2 rate control in light of CVE-2023-44487, possibly incrementing the default rate.

(in case github/advisory-database#2869 isn't fixed, use top level link https://nvd.nist.gov/vuln/detail/CVE-2023-44487)
@sbordet sbordet self-assigned this Oct 9, 2023
sbordet added a commit that referenced this issue Oct 9, 2023
@sbordet
Fixes #10679 - Review HTTP/2 rate control.
0f246d1 
* Bumped the rate control rate from 50 events/s to 128.
* Added rate control for all CONTINUATION frames.
* Added rate control for invalid PUSH_PROMISE frames.
* Added rate control for RST_STREAM frames.
* Added rate control for all SETTINGS frames.
* Fixed growth of header block accumulation buffer.

Signed-off-by: Simone Bordet <[email protected]>
@sbordet sbordet linked a pull request Oct 9, 2023 that will close this issue
Fixes #10679 - Review HTTP/2 rate control (CVE-2023-44487) #10680
Merged
sbordet added a commit that referenced this issue Oct 9, 2023
@sbordet
Fixes #10679 - Review HTTP/2 rate control.
e337e26 
* Bumped the rate control rate from 50 events/s to 128.
* Added rate control for all CONTINUATION frames.
* Added rate control for invalid PUSH_PROMISE frames.
* Added rate control for RST_STREAM frames.
* Added rate control for all SETTINGS frames.
* Fixed growth of header block accumulation buffer.

Signed-off-by: Simone Bordet <[email protected]>
@sbordet sbordet linked a pull request Oct 9, 2023 that will close this issue
Fixes #10679 - Review HTTP/2 rate control (CVE-2023-44487) #10681
Merged
sbordet added a commit that referenced this issue Oct 9, 2023
@sbordet
Fixes #10679 - Review HTTP/2 rate control.
0d344f4 
* Bumped the rate control rate from 50 events/s to 128.
* Added rate control for all CONTINUATION frames.
* Added rate control for invalid PUSH_PROMISE frames.
* Added rate control for RST_STREAM frames.
* Added rate control for all SETTINGS frames.
* Fixed growth of header block accumulation buffer.

Signed-off-by: Simone Bordet <[email protected]>
@sbordet sbordet linked a pull request Oct 9, 2023 that will close this issue
Fixes #10679 - Review HTTP/2 rate control (CVE-2023-44487) #10682
Merged
joakime added a commit that referenced this issue Oct 9, 2023
@joakime
Merge pull request #10680 from eclipse/fix/jetty-9.4-10679-review-htt…
2a512c2 
…p2-rate-control

Fixes #10679 - Review HTTP/2 rate control.
sbordet added a commit that referenced this issue Oct 9, 2023
@sbordet
Fixes #10679 - Review HTTP/2 rate control. (#10681)
dbb9451 
* Bumped the rate control rate from 50 events/s to 128.
* Added rate control for all CONTINUATION frames.
* Added rate control for invalid PUSH_PROMISE frames.
* Added rate control for RST_STREAM frames.
* Added rate control for all SETTINGS frames.
* Fixed growth of header block accumulation buffer.

Signed-off-by: Simone Bordet <[email protected]>
sbordet added a commit that referenced this issue Oct 9, 2023
@sbordet
Fixes #10679 - Review HTTP/2 rate control. (#10682)
7bd6c52 
* Bumped the rate control rate from 50 events/s to 128.
* Added rate control for all CONTINUATION frames.
* Added rate control for invalid PUSH_PROMISE frames.
* Added rate control for RST_STREAM frames.
* Added rate control for all SETTINGS frames.
* Fixed growth of header block accumulation buffer.

Signed-off-by: Simone Bordet <[email protected]>
@joakime joakime changed the title Review HTTP/2 rate control Allow HTTP/2 rate control to mitigate HTTP/2 floods (CVE-2023-44487) Oct 10, 2023
@GoVulnBot GoVulnBot mentioned this issue Oct 10, 2023
Closed
@ankurjoshi9 ankurjoshi9 mentioned this issue Oct 11, 2023
Closed
chaudum referenced this issue in grafana/loki Oct 17, 2023
@renovate
chore(deps): update module golang.org/x/net to v0.17.0 [security] (re…
8879a2d 
…lease-2.8.x) (#10891)

[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| golang.org/x/net | indirect | minor | `v0.7.0` -> `v0.17.0` |

---

### Improper rendering of text nodes in golang.org/x/net/html
[CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) /
[GHSA-2wrh-6pvc-2jm9](https://togithub.com/advisories/GHSA-2wrh-6pvc-2jm9)

<details>
<summary>More information</summary>

#### Details
Text nodes not in the HTML namespace are incorrectly literally rendered,
causing text which should be escaped to not be. This could lead to an
XSS attack.

#### Severity
- CVSS Score: 6.1 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

#### References
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978)
- [https://go.dev/cl/514896](https://go.dev/cl/514896)
- [https://go.dev/issue/61615](https://go.dev/issue/61615)
-
[https://pkg.go.dev/vuln/GO-2023-1988](https://pkg.go.dev/vuln/GO-2023-1988)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-2wrh-6pvc-2jm9) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Improper rendering of text nodes in golang.org/x/net/html
[CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) /
[GHSA-2wrh-6pvc-2jm9](https://togithub.com/advisories/GHSA-2wrh-6pvc-2jm9)
/ [GO-2023-1988](https://pkg.go.dev/vuln/GO-2023-1988)

<details>
<summary>More information</summary>

#### Details
Text nodes not in the HTML namespace are incorrectly literally rendered,
causing text which should be escaped to not be. This could lead to an
XSS attack.

#### Severity
Unknown

#### References
- [https://go.dev/issue/61615](https://go.dev/issue/61615)
- [https://go.dev/cl/514896](https://go.dev/cl/514896)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2023-1988) and the [Go
Vulnerability Database](https://togithub.com/golang/vulndb) ([CC-BY
4.0](https://togithub.com/golang/vulndb#license)).
</details>

---

### swift-nio-http2 vulnerable to HTTP/2 Stream Cancellation Attack
[CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) /
[GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)

<details>
<summary>More information</summary>

#### Details
swift-nio-http2 is vulnerable to a denial-of-service vulnerability in
which a malicious client can create and then reset a large number of
HTTP/2 streams in a short period of time. This causes swift-nio-http2 to
commit to a large amount of expensive work which it then throws away,
including creating entirely new `Channel`s to serve the traffic. This
can easily overwhelm an `EventLoop` and prevent it from making forward
progress.

swift-nio-http2 1.28 contains a remediation for this issue that applies
reset counter using a sliding window. This constrains the number of
stream resets that may occur in a given window of time. Clients
violating this limit will have their connections torn down. This allows
clients to continue to cancel streams for legitimate reasons, while
constraining malicious actors.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

#### References
-
[https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf](https://togithub.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf)
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487)
-
[https://github.com/Azure/AKS/issues/3947](https://togithub.com/Azure/AKS/issues/3947)
-
[https://github.com/akka/akka-http/issues/4323](https://togithub.com/akka/akka-http/issues/4323)
-
[https://github.com/alibaba/tengine/issues/1872](https://togithub.com/alibaba/tengine/issues/1872)
-
[https://github.com/apache/apisix/issues/10320](https://togithub.com/apache/apisix/issues/10320)
-
[https://github.com/caddyserver/caddy/issues/5877](https://togithub.com/caddyserver/caddy/issues/5877)
-
[https://github.com/dotnet/announcements/issues/277](https://togithub.com/dotnet/announcements/issues/277)
-
[https://github.com/eclipse/jetty.project/issues/10679](https://togithub.com/eclipse/jetty.project/issues/10679)
-
[https://github.com/etcd-io/etcd/issues/16740](https://togithub.com/etcd-io/etcd/issues/16740)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
-
[https://github.com/haproxy/haproxy/issues/2312](https://togithub.com/haproxy/haproxy/issues/2312)
-
[https://github.com/hyperium/hyper/issues/3337](https://togithub.com/hyperium/hyper/issues/3337)
-
[https://github.com/junkurihara/rust-rpxy/issues/97](https://togithub.com/junkurihara/rust-rpxy/issues/97)
-
[https://github.com/kazu-yamamoto/http2/issues/93](https://togithub.com/kazu-yamamoto/http2/issues/93)
-
[https://github.com/ninenines/cowboy/issues/1615](https://togithub.com/ninenines/cowboy/issues/1615)
-
[https://github.com/openresty/openresty/issues/930](https://togithub.com/openresty/openresty/issues/930)
-
[https://github.com/opensearch-project/data-prepper/issues/3474](https://togithub.com/opensearch-project/data-prepper/issues/3474)
-
[https://github.com/tempesta-tech/tempesta/issues/1986](https://togithub.com/tempesta-tech/tempesta/issues/1986)
-
[https://github.com/varnishcache/varnish-cache/issues/3996](https://togithub.com/varnishcache/varnish-cache/issues/3996)
-
[https://github.com/apache/httpd-site/pull/10](https://togithub.com/apache/httpd-site/pull/10)
-
[https://github.com/apache/trafficserver/pull/10564](https://togithub.com/apache/trafficserver/pull/10564)
-
[https://github.com/envoyproxy/envoy/pull/30055](https://togithub.com/envoyproxy/envoy/pull/30055)
-
[https://github.com/facebook/proxygen/pull/466](https://togithub.com/facebook/proxygen/pull/466)
-
[https://github.com/grpc/grpc-go/pull/6703](https://togithub.com/grpc/grpc-go/pull/6703)
-
[https://github.com/h2o/h2o/pull/3291](https://togithub.com/h2o/h2o/pull/3291)
-
[https://github.com/kubernetes/kubernetes/pull/121120](https://togithub.com/kubernetes/kubernetes/pull/121120)
-
[https://github.com/line/armeria/pull/5232](https://togithub.com/line/armeria/pull/5232)
-
[https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632](https://togithub.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632)
-
[https://github.com/microsoft/CBL-Mariner/pull/6381](https://togithub.com/microsoft/CBL-Mariner/pull/6381)
-
[https://github.com/nghttp2/nghttp2/pull/1961](https://togithub.com/nghttp2/nghttp2/pull/1961)
-
[https://github.com/nodejs/node/pull/50121](https://togithub.com/nodejs/node/pull/50121)
-
[https://github.com/projectcontour/contour/pull/5826](https://togithub.com/projectcontour/contour/pull/5826)
-
[https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1](https://togithub.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1)
-
[https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61](https://togithub.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61)
-
[https://access.redhat.com/security/cve/cve-2023-44487](https://access.redhat.com/security/cve/cve-2023-44487)
-
[https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/](https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/)
-
[https://aws.amazon.com/security/security-bulletins/AWS-2023-011/](https://aws.amazon.com/security/security-bulletins/AWS-2023-011/)
-
[https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/](https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/)
-
[https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/](https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/)
-
[https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/](https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/)
-
[https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack](https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack)
-
[https://blog.vespa.ai/cve-2023-44487/](https://blog.vespa.ai/cve-2023-44487/)
-
[https://bugzilla.proxmox.com/show_bug.cgi?id=4988](https://bugzilla.proxmox.com/show_bug.cgi?id=4988)
-
[https://bugzilla.redhat.com/show_bug.cgi?id=2242803](https://bugzilla.redhat.com/show_bug.cgi?id=2242803)
-
[https://bugzilla.suse.com/show_bug.cgi?id=1216123](https://bugzilla.suse.com/show_bug.cgi?id=1216123)
-
[https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9](https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9)
-
[https://chaos.social/@&#8203;icing/111210915918780532](https://chaos.social/@&#8203;icing/111210915918780532)
-
[https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/](https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/)
-
[https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack](https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack)
-
[https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125](https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125)
-
[https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve](https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve)
-
[https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764](https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764)
-
[https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088](https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088)
-
[https://github.com/Kong/kong/discussions/11741](https://togithub.com/Kong/kong/discussions/11741)
-
[https://github.com/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/advisories/GHSA-vx74-f528-fxqg](https://togithub.com/advisories/GHSA-vx74-f528-fxqg)
-
[https://github.com/advisories/GHSA-xpw8-rcwv-8f8p](https://togithub.com/advisories/GHSA-xpw8-rcwv-8f8p)
-
[https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113](https://togithub.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113)
-
[https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2](https://togithub.com/apache/tomcat/tree/main/java/org/apache/coyote/http2)
-
[https://github.com/apple/swift-nio-http2](https://togithub.com/apple/swift-nio-http2)
-
[https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487](https://togithub.com/arkrwn/PoC/tree/main/CVE-2023-44487)
-
[https://github.com/bcdannyboy/CVE-2023-44487](https://togithub.com/bcdannyboy/CVE-2023-44487)
-
[https://github.com/caddyserver/caddy/releases/tag/v2.7.5](https://togithub.com/caddyserver/caddy/releases/tag/v2.7.5)
-
[https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73](https://togithub.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73)
-
[https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244](https://togithub.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244)
-
[https://github.com/micrictor/http2-rst-stream](https://togithub.com/micrictor/http2-rst-stream)
-
[https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0](https://togithub.com/nghttp2/nghttp2/releases/tag/v1.57.0)
-
[https://github.com/oqtane/oqtane.framework/discussions/3367](https://togithub.com/oqtane/oqtane.framework/discussions/3367)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://istio.io/latest/news/security/istio-security-2023-004/](https://istio.io/latest/news/security/istio-security-2023-004/)
-
[https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/](https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/)
-
[https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q](https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/](https://lists.fedoraproject.org/archives/list/[email protected]/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/)
-
[https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html](https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html)
-
[https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html](https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html)
-
[https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html](https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html)
-
[https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/](https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/)
-
[https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487)
-
[https://my.f5.com/manage/s/article/K000137106](https://my.f5.com/manage/s/article/K000137106)
-
[https://netty.io/news/2023/10/10/4-1-100-Final.html](https://netty.io/news/2023/10/10/4-1-100-Final.html)
-
[https://news.ycombinator.com/item?id=37830987](https://news.ycombinator.com/item?id=37830987)
-
[https://news.ycombinator.com/item?id=37830998](https://news.ycombinator.com/item?id=37830998)
-
[https://news.ycombinator.com/item?id=37831062](https://news.ycombinator.com/item?id=37831062)
-
[https://news.ycombinator.com/item?id=37837043](https://news.ycombinator.com/item?id=37837043)
-
[https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/](https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/)
-
[https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected](https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected)
-
[https://security.netapp.com/advisory/ntap-20231016-0001/](https://security.netapp.com/advisory/ntap-20231016-0001/)
-
[https://security.paloaltonetworks.com/CVE-2023-44487](https://security.paloaltonetworks.com/CVE-2023-44487)
-
[https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14](https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14)
-
[https://ubuntu.com/security/CVE-2023-44487](https://ubuntu.com/security/CVE-2023-44487)
-
[https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/](https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/)
-
[https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487](https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487)
-
[https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event](https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event)
-
[https://www.debian.org/security/2023/dsa-5521](https://www.debian.org/security/2023/dsa-5521)
-
[https://www.debian.org/security/2023/dsa-5522](https://www.debian.org/security/2023/dsa-5522)
-
[https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487](https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487)
-
[https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/](https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/)
-
[https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/](https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/)
-
[https://www.openwall.com/lists/oss-security/2023/10/10/6](https://www.openwall.com/lists/oss-security/2023/10/10/6)
-
[https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack](https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack)
-
[https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/](https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/4](http://www.openwall.com/lists/oss-security/2023/10/13/4)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/9](http://www.openwall.com/lists/oss-security/2023/10/13/9)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-qppj-fm5r-hxr3) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### HTTP/2 rapid reset can cause excessive work in net/http
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
Moderate

#### References
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://pkg.go.dev/vuln/GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)
- [golang.org/x/net](golang.org/x/net)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-4374-p667-p6c8) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### HTTP/2 rapid reset can cause excessive work in net/http
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)
/ [GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
Unknown

#### References
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2023-2102) and the [Go
Vulnerability Database](https://togithub.com/golang/vulndb) ([CC-BY
4.0](https://togithub.com/golang/vulndb#license)).
</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/grafana/loki).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy44LjEiLCJ1cGRhdGVkSW5WZXIiOiIzNy4xOS4yIiwidGFyZ2V0QnJhbmNoIjoicmVsZWFzZS0yLjgueCJ9-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
mend-for-github-com bot referenced this issue in DelineaXPM/dsv-k8s Jan 10, 2024
@mend-for-github-com
chore(deps): update ⬆️ gomod to v0.17.0 (#112)
32db48f 
This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| golang.org/x/net | `v0.13.0` -> `v0.17.0` |
[![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fnet/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/go/golang.org%2fx%2fnet/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/go/golang.org%2fx%2fnet/v0.13.0/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fnet/v0.13.0/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

#### [CVE-2023-39325](https://togithub.com/golang/go/issues/63417)

A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

####
[CVE-2023-44487](https://togithub.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3)

## HTTP/2 Rapid reset attack
The HTTP/2 protocol allows clients to indicate to the server that a
previous stream should be canceled by sending a RST_STREAM frame. The
protocol does not require the client and server to coordinate the
cancellation in any way, the client may do it unilaterally. The client
may also assume that the cancellation will take effect immediately when
the server receives the RST_STREAM frame, before any other data from
that TCP connection is processed.

Abuse of this feature is called a Rapid Reset attack because it relies
on the ability for an endpoint to send a RST_STREAM frame immediately
after sending a request frame, which makes the other endpoint start
working and then rapidly resets the request. The request is canceled,
but leaves the HTTP/2 connection open.

The HTTP/2 Rapid Reset attack built on this capability is simple: The
client opens a large number of streams at once as in the standard HTTP/2
attack, but rather than waiting for a response to each request stream
from the server or proxy, the client cancels each request immediately.

The ability to reset streams immediately allows each connection to have
an indefinite number of requests in flight. By explicitly canceling the
requests, the attacker never exceeds the limit on the number of
concurrent open streams. The number of in-flight requests is no longer
dependent on the round-trip time (RTT), but only on the available
network bandwidth.

In a typical HTTP/2 server implementation, the server will still have to
do significant amounts of work for canceled requests, such as allocating
new stream data structures, parsing the query and doing header
decompression, and mapping the URL to a resource. For reverse proxy
implementations, the request may be proxied to the backend server before
the RST_STREAM frame is processed. The client on the other hand paid
almost no costs for sending the requests. This creates an exploitable
cost asymmetry between the server and the client.

Multiple software artifacts implementing HTTP/2 are affected. This
advisory was originally ingested from the `swift-nio-http2` repo
advisory and their original conent follows.

## swift-nio-http2 specific advisory
swift-nio-http2 is vulnerable to a denial-of-service vulnerability in
which a malicious client can create and then reset a large number of
HTTP/2 streams in a short period of time. This causes swift-nio-http2 to
commit to a large amount of expensive work which it then throws away,
including creating entirely new `Channel`s to serve the traffic. This
can easily overwhelm an `EventLoop` and prevent it from making forward
progress.

swift-nio-http2 1.28 contains a remediation for this issue that applies
reset counter using a sliding window. This constrains the number of
stream resets that may occur in a given window of time. Clients
violating this limit will have their connections torn down. This allows
clients to continue to cancel streams for legitimate reasons, while
constraining malicious actors.

---

### HTTP/2 rapid reset can cause excessive work in net/http
BIT-golang-2023-39325 /
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)
/ [GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
- CVSS Score: 7.5 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

#### References
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/](https://lists.fedoraproject.org/archives/list/[email protected]/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/](https://lists.fedoraproject.org/archives/list/[email protected]/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/](https://lists.fedoraproject.org/archives/list/[email protected]/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/[email protected]/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/](https://lists.fedoraproject.org/archives/list/[email protected]/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/](https://lists.fedoraproject.org/archives/list/[email protected]/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/](https://lists.fedoraproject.org/archives/list/[email protected]/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/](https://lists.fedoraproject.org/archives/list/[email protected]/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/[email protected]/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/](https://lists.fedoraproject.org/archives/list/[email protected]/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/](https://lists.fedoraproject.org/archives/list/[email protected]/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/](https://lists.fedoraproject.org/archives/list/[email protected]/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/](https://lists.fedoraproject.org/archives/list/[email protected]/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/](https://lists.fedoraproject.org/archives/list/[email protected]/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/](https://lists.fedoraproject.org/archives/list/[email protected]/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/](https://lists.fedoraproject.org/archives/list/[email protected]/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/](https://lists.fedoraproject.org/archives/list/[email protected]/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/](https://lists.fedoraproject.org/archives/list/[email protected]/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/[email protected]/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/](https://lists.fedoraproject.org/archives/list/[email protected]/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/](https://lists.fedoraproject.org/archives/list/[email protected]/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/)
-
[https://pkg.go.dev/vuln/GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)
-
[https://security.gentoo.org/glsa/202311-09](https://security.gentoo.org/glsa/202311-09)
-
[https://security.netapp.com/advisory/ntap-20231110-0008/](https://security.netapp.com/advisory/ntap-20231110-0008/)
- [golang.org/x/net](golang.org/x/net)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-4374-p667-p6c8) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### HTTP/2 rapid reset can cause excessive work in net/http
BIT-golang-2023-39325 /
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)
/ [GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
Unknown

#### References
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2023-2102) and the [Go
Vulnerability Database](https://togithub.com/golang/vulndb) ([CC-BY
4.0](https://togithub.com/golang/vulndb#license)).
</details>

---

### HTTP/2 Stream Cancellation Attack
BIT-apisix-2023-44487 / BIT-aspnet-core-2023-44487 /
BIT-contour-2023-44487 / BIT-dotnet-2023-44487 /
BIT-dotnet-sdk-2023-44487 / BIT-envoy-2023-44487 / BIT-golang-2023-44487
/ BIT-jenkins-2023-44487 / BIT-kong-2023-44487 / BIT-nginx-2023-44487 /
BIT-nginx-ingress-controller-2023-44487 / BIT-node-2023-44487 /
BIT-solr-2023-44487 / BIT-tomcat-2023-44487 / BIT-varnish-2023-44487 /
[CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) /
[GHSA-2m7v-gc89-fjqf](https://togithub.com/advisories/GHSA-2m7v-gc89-fjqf)
/
[GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)
/
[GHSA-vx74-f528-fxqg](https://togithub.com/advisories/GHSA-vx74-f528-fxqg)
/
[GHSA-xpw8-rcwv-8f8p](https://togithub.com/advisories/GHSA-xpw8-rcwv-8f8p)

<details>
<summary>More information</summary>

#### Details
##### HTTP/2 Rapid reset attack
The HTTP/2 protocol allows clients to indicate to the server that a
previous stream should be canceled by sending a RST_STREAM frame. The
protocol does not require the client and server to coordinate the
cancellation in any way, the client may do it unilaterally. The client
may also assume that the cancellation will take effect immediately when
the server receives the RST_STREAM frame, before any other data from
that TCP connection is processed.

Abuse of this feature is called a Rapid Reset attack because it relies
on the ability for an endpoint to send a RST_STREAM frame immediately
after sending a request frame, which makes the other endpoint start
working and then rapidly resets the request. The request is canceled,
but leaves the HTTP/2 connection open.

The HTTP/2 Rapid Reset attack built on this capability is simple: The
client opens a large number of streams at once as in the standard HTTP/2
attack, but rather than waiting for a response to each request stream
from the server or proxy, the client cancels each request immediately.

The ability to reset streams immediately allows each connection to have
an indefinite number of requests in flight. By explicitly canceling the
requests, the attacker never exceeds the limit on the number of
concurrent open streams. The number of in-flight requests is no longer
dependent on the round-trip time (RTT), but only on the available
network bandwidth.

In a typical HTTP/2 server implementation, the server will still have to
do significant amounts of work for canceled requests, such as allocating
new stream data structures, parsing the query and doing header
decompression, and mapping the URL to a resource. For reverse proxy
implementations, the request may be proxied to the backend server before
the RST_STREAM frame is processed. The client on the other hand paid
almost no costs for sending the requests. This creates an exploitable
cost asymmetry between the server and the client.

Multiple software artifacts implementing HTTP/2 are affected. This
advisory was originally ingested from the `swift-nio-http2` repo
advisory and their original conent follows.

##### swift-nio-http2 specific advisory
swift-nio-http2 is vulnerable to a denial-of-service vulnerability in
which a malicious client can create and then reset a large number of
HTTP/2 streams in a short period of time. This causes swift-nio-http2 to
commit to a large amount of expensive work which it then throws away,
including creating entirely new `Channel`s to serve the traffic. This
can easily overwhelm an `EventLoop` and prevent it from making forward
progress.

swift-nio-http2 1.28 contains a remediation for this issue that applies
reset counter using a sliding window. This constrains the number of
stream resets that may occur in a given window of time. Clients
violating this limit will have their connections torn down. This allows
clients to continue to cancel streams for legitimate reasons, while
constraining malicious actors.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

#### References
-
[https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf](https://togithub.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf)
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487)
-
[https://github.com/Azure/AKS/issues/3947](https://togithub.com/Azure/AKS/issues/3947)
-
[https://github.com/akka/akka-http/issues/4323](https://togithub.com/akka/akka-http/issues/4323)
-
[https://github.com/alibaba/tengine/issues/1872](https://togithub.com/alibaba/tengine/issues/1872)
-
[https://github.com/apache/apisix/issues/10320](https://togithub.com/apache/apisix/issues/10320)
-
[https://github.com/caddyserver/caddy/issues/5877](https://togithub.com/caddyserver/caddy/issues/5877)
-
[https://github.com/dotnet/announcements/issues/277](https://togithub.com/dotnet/announcements/issues/277)
-
[https://github.com/eclipse/jetty.project/issues/10679](https://togithub.com/eclipse/jetty.project/issues/10679)
-
[https://github.com/etcd-io/etcd/issues/16740](https://togithub.com/etcd-io/etcd/issues/16740)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
-
[https://github.com/haproxy/haproxy/issues/2312](https://togithub.com/haproxy/haproxy/issues/2312)
-
[https://github.com/hyperium/hyper/issues/3337](https://togithub.com/hyperium/hyper/issues/3337)
-
[https://github.com/junkurihara/rust-rpxy/issues/97](https://togithub.com/junkurihara/rust-rpxy/issues/97)
-
[https://github.com/kazu-yamamoto/http2/issues/93](https://togithub.com/kazu-yamamoto/http2/issues/93)
-
[https://github.com/ninenines/cowboy/issues/1615](https://togithub.com/ninenines/cowboy/issues/1615)
-
[https://github.com/openresty/openresty/issues/930](https://togithub.com/openresty/openresty/issues/930)
-
[https://github.com/opensearch-project/data-prepper/issues/3474](https://togithub.com/opensearch-project/data-prepper/issues/3474)
-
[https://github.com/tempesta-tech/tempesta/issues/1986](https://togithub.com/tempesta-tech/tempesta/issues/1986)
-
[https://github.com/varnishcache/varnish-cache/issues/3996](https://togithub.com/varnishcache/varnish-cache/issues/3996)
-
[https://github.com/apache/httpd-site/pull/10](https://togithub.com/apache/httpd-site/pull/10)
-
[https://github.com/apache/trafficserver/pull/10564](https://togithub.com/apache/trafficserver/pull/10564)
-
[https://github.com/envoyproxy/envoy/pull/30055](https://togithub.com/envoyproxy/envoy/pull/30055)
-
[https://github.com/facebook/proxygen/pull/466](https://togithub.com/facebook/proxygen/pull/466)
-
[https://github.com/grpc/grpc-go/pull/6703](https://togithub.com/grpc/grpc-go/pull/6703)
-
[https://github.com/h2o/h2o/pull/3291](https://togithub.com/h2o/h2o/pull/3291)
-
[https://github.com/kubernetes/kubernetes/pull/121120](https://togithub.com/kubernetes/kubernetes/pull/121120)
-
[https://github.com/line/armeria/pull/5232](https://togithub.com/line/armeria/pull/5232)
-
[https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632](https://togithub.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632)
-
[https://github.com/microsoft/CBL-Mariner/pull/6381](https://togithub.com/microsoft/CBL-Mariner/pull/6381)
-
[https://github.com/nghttp2/nghttp2/pull/1961](https://togithub.com/nghttp2/nghttp2/pull/1961)
-
[https://github.com/nodejs/node/pull/50121](https://togithub.com/nodejs/node/pull/50121)
-
[https://github.com/projectcontour/contour/pull/5826](https://togithub.com/projectcontour/contour/pull/5826)
-
[https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1](https://togithub.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1)
-
[https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61](https://togithub.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61)
-
[https://access.redhat.com/security/cve/cve-2023-44487](https://access.redhat.com/security/cve/cve-2023-44487)
-
[https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/](https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/)
-
[https://aws.amazon.com/security/security-bulletins/AWS-2023-011/](https://aws.amazon.com/security/security-bulletins/AWS-2023-011/)
-
[https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/](https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/)
-
[https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/](https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/)
-
[https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/](https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/)
-
[https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack](https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack)
-
[https://blog.vespa.ai/cve-2023-44487/](https://blog.vespa.ai/cve-2023-44487/)
-
[https://bugzilla.proxmox.com/show_bug.cgi?id=4988](https://bugzilla.proxmox.com/show_bug.cgi?id=4988)
-
[https://bugzilla.redhat.com/show_bug.cgi?id=2242803](https://bugzilla.redhat.com/show_bug.cgi?id=2242803)
-
[https://bugzilla.suse.com/show_bug.cgi?id=1216123](https://bugzilla.suse.com/show_bug.cgi?id=1216123)
-
[https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9](https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9)
-
[https://chaos.social/@&#8203;icing/111210915918780532](https://chaos.social/@&#8203;icing/111210915918780532)
-
[https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/](https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/)
-
[https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack](https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack)
-
[https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125](https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125)
-
[https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715](https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715)
-
[https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve](https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve)
-
[https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764](https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764)
-
[https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088](https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088)
-
[https://github.com/Kong/kong/discussions/11741](https://togithub.com/Kong/kong/discussions/11741)
-
[https://github.com/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/advisories/GHSA-vx74-f528-fxqg](https://togithub.com/advisories/GHSA-vx74-f528-fxqg)
-
[https://github.com/advisories/GHSA-xpw8-rcwv-8f8p](https://togithub.com/advisories/GHSA-xpw8-rcwv-8f8p)
-
[https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113](https://togithub.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113)
-
[https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2](https://togithub.com/apache/tomcat/tree/main/java/org/apache/coyote/http2)
-
[https://github.com/apple/swift-nio-http2](https://togithub.com/apple/swift-nio-http2)
-
[https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487](https://togithub.com/arkrwn/PoC/tree/main/CVE-2023-44487)
-
[https://github.com/bcdannyboy/CVE-2023-44487](https://togithub.com/bcdannyboy/CVE-2023-44487)
-
[https://github.com/caddyserver/caddy/releases/tag/v2.7.5](https://togithub.com/caddyserver/caddy/releases/tag/v2.7.5)
-
[https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73](https://togithub.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73)
-
[https://github.com/grpc/grpc-go/releases](https://togithub.com/grpc/grpc-go/releases)
-
[https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244](https://togithub.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244)
-
[https://github.com/micrictor/http2-rst-stream](https://togithub.com/micrictor/http2-rst-stream)
-
[https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0](https://togithub.com/nghttp2/nghttp2/releases/tag/v1.57.0)
-
[https://github.com/oqtane/oqtane.framework/discussions/3367](https://togithub.com/oqtane/oqtane.framework/discussions/3367)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://istio.io/latest/news/security/istio-security-2023-004/](https://istio.io/latest/news/security/istio-security-2023-004/)
-
[https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/](https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/)
-
[https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q](https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html)
-
[https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html](https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html)
-
[https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html](https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/](https://lists.fedoraproject.org/archives/list/[email protected]/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/](https://lists.fedoraproject.org/archives/list/[email protected]/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/[email protected]/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/](https://lists.fedoraproject.org/archives/list/[email protected]/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/](https://lists.fedoraproject.org/archives/list/[email protected]/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/](https://lists.fedoraproject.org/archives/list/[email protected]/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/](https://lists.fedoraproject.org/archives/list/[email protected]/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/](https://lists.fedoraproject.org/archives/list/[email protected]/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/[email protected]/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/](https://lists.fedoraproject.org/archives/list/[email protected]/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/](https://lists.fedoraproject.org/archives/list/[email protected]/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/](https://lists.fedoraproject.org/archives/list/[email protected]/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/](https://lists.fedoraproject.org/archives/list/[email protected]/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/](https://lists.fedoraproject.org/archives/list/[email protected]/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/](https://lists.fedoraproject.org/archives/list/[email protected]/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/[email protected]/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/](https://lists.fedoraproject.org/archives/list/[email protected]/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/](https://lists.fedoraproject.org/archives/list/[email protected]/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/](https://lists.fedoraproject.org/archives/list/[email protected]/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/)
-
[https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html](https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html)
-
[https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html](https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html)
-
[https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html](https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html)
-
[https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/](https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/)
-
[https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487)
-
[https://my.f5.com/manage/s/article/K000137106](https://my.f5.com/manage/s/article/K000137106)
-
[https://netty.io/news/2023/10/10/4-1-100-Final.html](https://netty.io/news/2023/10/10/4-1-100-Final.html)
-
[https://news.ycombinator.com/item?id=37830987](https://news.ycombinator.com/item?id=37830987)
-
[https://news.ycombinator.com/item?id=37830998](https://news.ycombinator.com/item?id=37830998)
-
[https://news.ycombinator.com/item?id=37831062](https://news.ycombinator.com/item?id=37831062)
-
[https://news.ycombinator.com/item?id=37837043](https://news.ycombinator.com/item?id=37837043)
-
[https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/](https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/)
-
[https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected](https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected)
-
[https://security.gentoo.org/glsa/202311-09](https://security.gentoo.org/glsa/202311-09)
-
[https://security.netapp.com/advisory/ntap-20231016-0001/](https://security.netapp.com/advisory/ntap-20231016-0001/)
-
[https://security.paloaltonetworks.com/CVE-2023-44487](https://security.paloaltonetworks.com/CVE-2023-44487)
-
[https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14](https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14)
-
[https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12](https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12)
-
[https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94](https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94)
-
[https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81](https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81)
-
[https://ubuntu.com/security/CVE-2023-44487](https://ubuntu.com/security/CVE-2023-44487)
-
[https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/](https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/)
-
[https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487](https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487)
-
[https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event](https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event)
-
[https://www.debian.org/security/2023/dsa-5521](https://www.debian.org/security/2023/dsa-5521)
-
[https://www.debian.org/security/2023/dsa-5522](https://www.debian.org/security/2023/dsa-5522)
-
[https://www.debian.org/security/2023/dsa-5540](https://www.debian.org/security/2023/dsa-5540)
-
[https://www.debian.org/security/2023/dsa-5549](https://www.debian.org/security/2023/dsa-5549)
-
[https://www.debian.org/security/2023/dsa-5558](https://www.debian.org/security/2023/dsa-5558)
-
[https://www.debian.org/security/2023/dsa-5570](https://www.debian.org/security/2023/dsa-5570)
-
[https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487](https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487)
-
[https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/](https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/)
-
[https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/](https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/)
-
[https://www.openwall.com/lists/oss-security/2023/10/10/6](https://www.openwall.com/lists/oss-security/2023/10/10/6)
-
[https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack](https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack)
-
[https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/](https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/4](http://www.openwall.com/lists/oss-security/2023/10/13/4)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/9](http://www.openwall.com/lists/oss-security/2023/10/13/9)
-
[http://www.openwall.com/lists/oss-security/2023/10/18/4](http://www.openwall.com/lists/oss-security/2023/10/18/4)
-
[http://www.openwall.com/lists/oss-security/2023/10/18/8](http://www.openwall.com/lists/oss-security/2023/10/18/8)
-
[http://www.openwall.com/lists/oss-security/2023/10/19/6](http://www.openwall.com/lists/oss-security/2023/10/19/6)
-
[http://www.openwall.com/lists/oss-security/2023/10/20/8](http://www.openwall.com/lists/oss-security/2023/10/20/8)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-qppj-fm5r-hxr3) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy41Mi4wIiwidXBkYXRlZEluVmVyIjoiMzcuMTA4LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIn0=-->

Co-authored-by: mend-for-github-com[bot] <50673670+mend-for-github-com[bot]@users.noreply.github.com>
mend-for-github-com bot referenced this issue in DelineaXPM/dsv-k8s-sidecar Jan 15, 2024
@mend-for-github-com
chore(deps): update ⬆️ gomod to v0.17.0 (#51)
c0226fe 
This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| golang.org/x/net | `v0.13.0` -> `v0.17.0` |
[![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fnet/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/go/golang.org%2fx%2fnet/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/go/golang.org%2fx%2fnet/v0.13.0/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fnet/v0.13.0/v0.17.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

#### [CVE-2023-39325](https://togithub.com/golang/go/issues/63417)

A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

####
[CVE-2023-44487](https://togithub.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3)

## HTTP/2 Rapid reset attack
The HTTP/2 protocol allows clients to indicate to the server that a
previous stream should be canceled by sending a RST_STREAM frame. The
protocol does not require the client and server to coordinate the
cancellation in any way, the client may do it unilaterally. The client
may also assume that the cancellation will take effect immediately when
the server receives the RST_STREAM frame, before any other data from
that TCP connection is processed.

Abuse of this feature is called a Rapid Reset attack because it relies
on the ability for an endpoint to send a RST_STREAM frame immediately
after sending a request frame, which makes the other endpoint start
working and then rapidly resets the request. The request is canceled,
but leaves the HTTP/2 connection open.

The HTTP/2 Rapid Reset attack built on this capability is simple: The
client opens a large number of streams at once as in the standard HTTP/2
attack, but rather than waiting for a response to each request stream
from the server or proxy, the client cancels each request immediately.

The ability to reset streams immediately allows each connection to have
an indefinite number of requests in flight. By explicitly canceling the
requests, the attacker never exceeds the limit on the number of
concurrent open streams. The number of in-flight requests is no longer
dependent on the round-trip time (RTT), but only on the available
network bandwidth.

In a typical HTTP/2 server implementation, the server will still have to
do significant amounts of work for canceled requests, such as allocating
new stream data structures, parsing the query and doing header
decompression, and mapping the URL to a resource. For reverse proxy
implementations, the request may be proxied to the backend server before
the RST_STREAM frame is processed. The client on the other hand paid
almost no costs for sending the requests. This creates an exploitable
cost asymmetry between the server and the client.

Multiple software artifacts implementing HTTP/2 are affected. This
advisory was originally ingested from the `swift-nio-http2` repo
advisory and their original conent follows.

## swift-nio-http2 specific advisory
swift-nio-http2 is vulnerable to a denial-of-service vulnerability in
which a malicious client can create and then reset a large number of
HTTP/2 streams in a short period of time. This causes swift-nio-http2 to
commit to a large amount of expensive work which it then throws away,
including creating entirely new `Channel`s to serve the traffic. This
can easily overwhelm an `EventLoop` and prevent it from making forward
progress.

swift-nio-http2 1.28 contains a remediation for this issue that applies
reset counter using a sliding window. This constrains the number of
stream resets that may occur in a given window of time. Clients
violating this limit will have their connections torn down. This allows
clients to continue to cancel streams for legitimate reasons, while
constraining malicious actors.

---

### HTTP/2 rapid reset can cause excessive work in net/http
BIT-golang-2023-39325 /
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)
/ [GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
Unknown

#### References
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2023-2102) and the [Go
Vulnerability Database](https://togithub.com/golang/vulndb) ([CC-BY
4.0](https://togithub.com/golang/vulndb#license)).
</details>

---

### HTTP/2 Stream Cancellation Attack
BIT-apisix-2023-44487 / BIT-aspnet-core-2023-44487 /
BIT-contour-2023-44487 / BIT-dotnet-2023-44487 /
BIT-dotnet-sdk-2023-44487 / BIT-envoy-2023-44487 / BIT-golang-2023-44487
/ BIT-jenkins-2023-44487 / BIT-kong-2023-44487 / BIT-nginx-2023-44487 /
BIT-nginx-ingress-controller-2023-44487 / BIT-node-2023-44487 /
BIT-solr-2023-44487 / BIT-tomcat-2023-44487 / BIT-varnish-2023-44487 /
[CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) /
[GHSA-2m7v-gc89-fjqf](https://togithub.com/advisories/GHSA-2m7v-gc89-fjqf)
/
[GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)
/
[GHSA-vx74-f528-fxqg](https://togithub.com/advisories/GHSA-vx74-f528-fxqg)
/
[GHSA-xpw8-rcwv-8f8p](https://togithub.com/advisories/GHSA-xpw8-rcwv-8f8p)

<details>
<summary>More information</summary>

#### Details
##### HTTP/2 Rapid reset attack
The HTTP/2 protocol allows clients to indicate to the server that a
previous stream should be canceled by sending a RST_STREAM frame. The
protocol does not require the client and server to coordinate the
cancellation in any way, the client may do it unilaterally. The client
may also assume that the cancellation will take effect immediately when
the server receives the RST_STREAM frame, before any other data from
that TCP connection is processed.

Abuse of this feature is called a Rapid Reset attack because it relies
on the ability for an endpoint to send a RST_STREAM frame immediately
after sending a request frame, which makes the other endpoint start
working and then rapidly resets the request. The request is canceled,
but leaves the HTTP/2 connection open.

The HTTP/2 Rapid Reset attack built on this capability is simple: The
client opens a large number of streams at once as in the standard HTTP/2
attack, but rather than waiting for a response to each request stream
from the server or proxy, the client cancels each request immediately.

The ability to reset streams immediately allows each connection to have
an indefinite number of requests in flight. By explicitly canceling the
requests, the attacker never exceeds the limit on the number of
concurrent open streams. The number of in-flight requests is no longer
dependent on the round-trip time (RTT), but only on the available
network bandwidth.

In a typical HTTP/2 server implementation, the server will still have to
do significant amounts of work for canceled requests, such as allocating
new stream data structures, parsing the query and doing header
decompression, and mapping the URL to a resource. For reverse proxy
implementations, the request may be proxied to the backend server before
the RST_STREAM frame is processed. The client on the other hand paid
almost no costs for sending the requests. This creates an exploitable
cost asymmetry between the server and the client.

Multiple software artifacts implementing HTTP/2 are affected. This
advisory was originally ingested from the `swift-nio-http2` repo
advisory and their original conent follows.

##### swift-nio-http2 specific advisory
swift-nio-http2 is vulnerable to a denial-of-service vulnerability in
which a malicious client can create and then reset a large number of
HTTP/2 streams in a short period of time. This causes swift-nio-http2 to
commit to a large amount of expensive work which it then throws away,
including creating entirely new `Channel`s to serve the traffic. This
can easily overwhelm an `EventLoop` and prevent it from making forward
progress.

swift-nio-http2 1.28 contains a remediation for this issue that applies
reset counter using a sliding window. This constrains the number of
stream resets that may occur in a given window of time. Clients
violating this limit will have their connections torn down. This allows
clients to continue to cancel streams for legitimate reasons, while
constraining malicious actors.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

#### References
-
[https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf](https://togithub.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf)
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487)
-
[https://github.com/Azure/AKS/issues/3947](https://togithub.com/Azure/AKS/issues/3947)
-
[https://github.com/akka/akka-http/issues/4323](https://togithub.com/akka/akka-http/issues/4323)
-
[https://github.com/alibaba/tengine/issues/1872](https://togithub.com/alibaba/tengine/issues/1872)
-
[https://github.com/apache/apisix/issues/10320](https://togithub.com/apache/apisix/issues/10320)
-
[https://github.com/caddyserver/caddy/issues/5877](https://togithub.com/caddyserver/caddy/issues/5877)
-
[https://github.com/dotnet/announcements/issues/277](https://togithub.com/dotnet/announcements/issues/277)
-
[https://github.com/eclipse/jetty.project/issues/10679](https://togithub.com/eclipse/jetty.project/issues/10679)
-
[https://github.com/etcd-io/etcd/issues/16740](https://togithub.com/etcd-io/etcd/issues/16740)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
-
[https://github.com/haproxy/haproxy/issues/2312](https://togithub.com/haproxy/haproxy/issues/2312)
-
[https://github.com/hyperium/hyper/issues/3337](https://togithub.com/hyperium/hyper/issues/3337)
-
[https://github.com/junkurihara/rust-rpxy/issues/97](https://togithub.com/junkurihara/rust-rpxy/issues/97)
-
[https://github.com/kazu-yamamoto/http2/issues/93](https://togithub.com/kazu-yamamoto/http2/issues/93)
-
[https://github.com/ninenines/cowboy/issues/1615](https://togithub.com/ninenines/cowboy/issues/1615)
-
[https://github.com/openresty/openresty/issues/930](https://togithub.com/openresty/openresty/issues/930)
-
[https://github.com/opensearch-project/data-prepper/issues/3474](https://togithub.com/opensearch-project/data-prepper/issues/3474)
-
[https://github.com/tempesta-tech/tempesta/issues/1986](https://togithub.com/tempesta-tech/tempesta/issues/1986)
-
[https://github.com/varnishcache/varnish-cache/issues/3996](https://togithub.com/varnishcache/varnish-cache/issues/3996)
-
[https://github.com/apache/httpd-site/pull/10](https://togithub.com/apache/httpd-site/pull/10)
-
[https://github.com/apache/trafficserver/pull/10564](https://togithub.com/apache/trafficserver/pull/10564)
-
[https://github.com/envoyproxy/envoy/pull/30055](https://togithub.com/envoyproxy/envoy/pull/30055)
-
[https://github.com/facebook/proxygen/pull/466](https://togithub.com/facebook/proxygen/pull/466)
-
[https://github.com/grpc/grpc-go/pull/6703](https://togithub.com/grpc/grpc-go/pull/6703)
-
[https://github.com/h2o/h2o/pull/3291](https://togithub.com/h2o/h2o/pull/3291)
-
[https://github.com/kubernetes/kubernetes/pull/121120](https://togithub.com/kubernetes/kubernetes/pull/121120)
-
[https://github.com/line/armeria/pull/5232](https://togithub.com/line/armeria/pull/5232)
-
[https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632](https://togithub.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632)
-
[https://github.com/microsoft/CBL-Mariner/pull/6381](https://togithub.com/microsoft/CBL-Mariner/pull/6381)
-
[https://github.com/nghttp2/nghttp2/pull/1961](https://togithub.com/nghttp2/nghttp2/pull/1961)
-
[https://github.com/nodejs/node/pull/50121](https://togithub.com/nodejs/node/pull/50121)
-
[https://github.com/projectcontour/contour/pull/5826](https://togithub.com/projectcontour/contour/pull/5826)
-
[https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1](https://togithub.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1)
-
[https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61](https://togithub.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61)
-
[https://access.redhat.com/security/cve/cve-2023-44487](https://access.redhat.com/security/cve/cve-2023-44487)
-
[https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/](https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/)
-
[https://aws.amazon.com/security/security-bulletins/AWS-2023-011/](https://aws.amazon.com/security/security-bulletins/AWS-2023-011/)
-
[https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/](https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/)
-
[https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/](https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/)
-
[https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/](https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/)
-
[https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack](https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack)
-
[https://blog.vespa.ai/cve-2023-44487/](https://blog.vespa.ai/cve-2023-44487/)
-
[https://bugzilla.proxmox.com/show_bug.cgi?id=4988](https://bugzilla.proxmox.com/show_bug.cgi?id=4988)
-
[https://bugzilla.redhat.com/show_bug.cgi?id=2242803](https://bugzilla.redhat.com/show_bug.cgi?id=2242803)
-
[https://bugzilla.suse.com/show_bug.cgi?id=1216123](https://bugzilla.suse.com/show_bug.cgi?id=1216123)
-
[https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9](https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9)
-
[https://chaos.social/@&#8203;icing/111210915918780532](https://chaos.social/@&#8203;icing/111210915918780532)
-
[https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/](https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/)
-
[https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack](https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack)
-
[https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125](https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125)
-
[https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715](https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715)
-
[https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve](https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve)
-
[https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764](https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764)
-
[https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088](https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088)
-
[https://github.com/Kong/kong/discussions/11741](https://togithub.com/Kong/kong/discussions/11741)
-
[https://github.com/advisories/GHSA-qppj-fm5r-hxr3](https://togithub.com/advisories/GHSA-qppj-fm5r-hxr3)
-
[https://github.com/advisories/GHSA-vx74-f528-fxqg](https://togithub.com/advisories/GHSA-vx74-f528-fxqg)
-
[https://github.com/advisories/GHSA-xpw8-rcwv-8f8p](https://togithub.com/advisories/GHSA-xpw8-rcwv-8f8p)
-
[https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113](https://togithub.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113)
-
[https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2](https://togithub.com/apache/tomcat/tree/main/java/org/apache/coyote/http2)
-
[https://github.com/apple/swift-nio-http2](https://togithub.com/apple/swift-nio-http2)
-
[https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487](https://togithub.com/arkrwn/PoC/tree/main/CVE-2023-44487)
-
[https://github.com/bcdannyboy/CVE-2023-44487](https://togithub.com/bcdannyboy/CVE-2023-44487)
-
[https://github.com/caddyserver/caddy/releases/tag/v2.7.5](https://togithub.com/caddyserver/caddy/releases/tag/v2.7.5)
-
[https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73](https://togithub.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73)
-
[https://github.com/grpc/grpc-go/releases](https://togithub.com/grpc/grpc-go/releases)
-
[https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244](https://togithub.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244)
-
[https://github.com/micrictor/http2-rst-stream](https://togithub.com/micrictor/http2-rst-stream)
-
[https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0](https://togithub.com/nghttp2/nghttp2/releases/tag/v1.57.0)
-
[https://github.com/oqtane/oqtane.framework/discussions/3367](https://togithub.com/oqtane/oqtane.framework/discussions/3367)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://istio.io/latest/news/security/istio-security-2023-004/](https://istio.io/latest/news/security/istio-security-2023-004/)
-
[https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/](https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/)
-
[https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q](https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html)
-
[https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html)
-
[https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html](https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html)
-
[https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html](https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/)
-
[https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/](https://lists.fedoraproject.org/archives/list/[email protected]/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/](https://lists.fedoraproject.org/archives/list/[email protected]/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/[email protected]/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/](https://lists.fedoraproject.org/archives/list/[email protected]/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/](https://lists.fedoraproject.org/archives/list/[email protected]/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/](https://lists.fedoraproject.org/archives/list/[email protected]/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/](https://lists.fedoraproject.org/archives/list/[email protected]/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/](https://lists.fedoraproject.org/archives/list/[email protected]/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/[email protected]/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/](https://lists.fedoraproject.org/archives/list/[email protected]/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/](https://lists.fedoraproject.org/archives/list/[email protected]/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/](https://lists.fedoraproject.org/archives/list/[email protected]/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/](https://lists.fedoraproject.org/archives/list/[email protected]/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/](https://lists.fedoraproject.org/archives/list/[email protected]/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/](https://lists.fedoraproject.org/archives/list/[email protected]/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/[email protected]/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/](https://lists.fedoraproject.org/archives/list/[email protected]/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/](https://lists.fedoraproject.org/archives/list/[email protected]/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/](https://lists.fedoraproject.org/archives/list/[email protected]/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/)
-
[https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html](https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html)
-
[https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html](https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html)
-
[https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html](https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html)
-
[https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/](https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/)
-
[https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487)
-
[https://my.f5.com/manage/s/article/K000137106](https://my.f5.com/manage/s/article/K000137106)
-
[https://netty.io/news/2023/10/10/4-1-100-Final.html](https://netty.io/news/2023/10/10/4-1-100-Final.html)
-
[https://news.ycombinator.com/item?id=37830987](https://news.ycombinator.com/item?id=37830987)
-
[https://news.ycombinator.com/item?id=37830998](https://news.ycombinator.com/item?id=37830998)
-
[https://news.ycombinator.com/item?id=37831062](https://news.ycombinator.com/item?id=37831062)
-
[https://news.ycombinator.com/item?id=37837043](https://news.ycombinator.com/item?id=37837043)
-
[https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/](https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/)
-
[https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected](https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected)
-
[https://security.gentoo.org/glsa/202311-09](https://security.gentoo.org/glsa/202311-09)
-
[https://security.netapp.com/advisory/ntap-20231016-0001/](https://security.netapp.com/advisory/ntap-20231016-0001/)
-
[https://security.paloaltonetworks.com/CVE-2023-44487](https://security.paloaltonetworks.com/CVE-2023-44487)
-
[https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14](https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14)
-
[https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12](https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12)
-
[https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94](https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94)
-
[https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81](https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81)
-
[https://ubuntu.com/security/CVE-2023-44487](https://ubuntu.com/security/CVE-2023-44487)
-
[https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/](https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/)
-
[https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487](https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487)
-
[https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event](https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event)
-
[https://www.debian.org/security/2023/dsa-5521](https://www.debian.org/security/2023/dsa-5521)
-
[https://www.debian.org/security/2023/dsa-5522](https://www.debian.org/security/2023/dsa-5522)
-
[https://www.debian.org/security/2023/dsa-5540](https://www.debian.org/security/2023/dsa-5540)
-
[https://www.debian.org/security/2023/dsa-5549](https://www.debian.org/security/2023/dsa-5549)
-
[https://www.debian.org/security/2023/dsa-5558](https://www.debian.org/security/2023/dsa-5558)
-
[https://www.debian.org/security/2023/dsa-5570](https://www.debian.org/security/2023/dsa-5570)
-
[https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487](https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487)
-
[https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/](https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/)
-
[https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/](https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/)
-
[https://www.openwall.com/lists/oss-security/2023/10/10/6](https://www.openwall.com/lists/oss-security/2023/10/10/6)
-
[https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack](https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack)
-
[https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/](https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/4](http://www.openwall.com/lists/oss-security/2023/10/13/4)
-
[http://www.openwall.com/lists/oss-security/2023/10/13/9](http://www.openwall.com/lists/oss-security/2023/10/13/9)
-
[http://www.openwall.com/lists/oss-security/2023/10/18/4](http://www.openwall.com/lists/oss-security/2023/10/18/4)
-
[http://www.openwall.com/lists/oss-security/2023/10/18/8](http://www.openwall.com/lists/oss-security/2023/10/18/8)
-
[http://www.openwall.com/lists/oss-security/2023/10/19/6](http://www.openwall.com/lists/oss-security/2023/10/19/6)
-
[http://www.openwall.com/lists/oss-security/2023/10/20/8](http://www.openwall.com/lists/oss-security/2023/10/20/8)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-qppj-fm5r-hxr3) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### HTTP/2 rapid reset can cause excessive work in net/http
BIT-golang-2023-39325 /
[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) /
[GHSA-4374-p667-p6c8](https://togithub.com/advisories/GHSA-4374-p667-p6c8)
/ [GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption. While the
total number of requests is bounded by the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

With the fix applied, HTTP/2 servers now bound the number of
simultaneously executing handler goroutines to the stream concurrency
limit (MaxConcurrentStreams). New requests arriving when at the limit
(which can only happen after the client has reset an existing, in-flight
request) will be queued until a handler exits. If the request queue
grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually
configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per
HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

#### Severity
- CVSS Score: 7.5 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

#### References
-
[https://nvd.nist.gov/vuln/detail/CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
-
[https://github.com/golang/go/issues/63417](https://togithub.com/golang/go/issues/63417)
- [https://go.dev/cl/534215](https://go.dev/cl/534215)
- [https://go.dev/cl/534235](https://go.dev/cl/534235)
- [https://go.dev/issue/63417](https://go.dev/issue/63417)
-
[https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/](https://lists.fedoraproject.org/archives/list/[email protected]/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/](https://lists.fedoraproject.org/archives/list/[email protected]/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/](https://lists.fedoraproject.org/archives/list/[email protected]/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/](https://lists.fedoraproject.org/archives/list/[email protected]/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/](https://lists.fedoraproject.org/archives/list/[email protected]/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/](https://lists.fedoraproject.org/archives/list/[email protected]/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/](https://lists.fedoraproject.org/archives/list/[email protected]/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/](https://lists.fedoraproject.org/archives/list/[email protected]/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/](https://lists.fedoraproject.org/archives/list/[email protected]/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/](https://lists.fedoraproject.org/archives/list/[email protected]/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/](https://lists.fedoraproject.org/archives/list/[email protected]/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/](https://lists.fedoraproject.org/archives/list/[email protected]/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/](https://lists.fedoraproject.org/archives/list/[email protected]/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/](https://lists.fedoraproject.org/archives/list/[email protected]/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/](https://lists.fedoraproject.org/archives/list/[email protected]/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/](https://lists.fedoraproject.org/archives/list/[email protected]/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/](https://lists.fedoraproject.org/archives/list/[email protected]/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/](https://lists.fedoraproject.org/archives/list/[email protected]/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/](https://lists.fedoraproject.org/archives/list/[email protected]/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/](https://lists.fedoraproject.org/archives/list/[email protected]/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/)
-
[https://lists.fedoraproject.org/archives/list/[email protected]/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/](https://lists.fedoraproject.org/archives/list/[email protected]/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/)
-
[https://pkg.go.dev/vuln/GO-2023-2102](https://pkg.go.dev/vuln/GO-2023-2102)
-
[https://security.gentoo.org/glsa/202311-09](https://security.gentoo.org/glsa/202311-09)
-
[https://security.netapp.com/advisory/ntap-20231110-0008/](https://security.netapp.com/advisory/ntap-20231110-0008/)
- [golang.org/x/net](golang.org/x/net)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-4374-p667-p6c8) and the [GitHub
Advisory Database](https://togithub.com/github/advisory-database)
([CC-BY
4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [x] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy41Mi4wIiwidXBkYXRlZEluVmVyIjoiMzcuMTA4LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIn0=-->

Co-authored-by: mend-for-github-com[bot] <50673670+mend-for-github-com[bot]@users.noreply.github.com>
@iamsanjay iamsanjay mentioned this issue Mar 28, 2024
Merged
7 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@sbordet sbordet

Labels
Enhancement Security
Projects
None yet
Milestone
No milestone
2 participants
@joakime @sbordet