io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack
GHSA-xpw8-rcwv-8f8p
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.
Impact
This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.
Patches
This is patched in version 4.1.100.Final.
Workarounds
A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own Http2FrameListener implementation or an ChannelInboundHandler implementation (depending which http2 API is used).
References
References
- WEB https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3
- WEB https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-44487
- WEB https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
- PACKAGE https://github.com/netty/netty
- WEB https://www.cve.org/CVERecord?id=CVE-2023-44487
Ready to move
Start Securing
Free, no credit card | First findings in minutes