CVE-2023-44487
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in...
- Published
- Oct 10, 2023
- Updated
- Oct 14, 2026
- Assigning CNA
- mitre
- Evidence observed
- Oct 10, 2023
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HHigh · next 30 days
- Percentile
- 100.0%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Sources
POC for CVE-2023-44487
Advanced CVE-2023-44487 HTTP/2 Rapid Reset vulnerability exploitation framework. Features multi-connection concurrent attacks, adaptive rate control, stealth mode with randomized headers, real-time metrics, and risk assessment reporting. For authorized penetration testing only. By Sudeepa Wanigarathna
Python-based testing tool for CVE-2023-44487 (HTTP/2 Rapid Reset) with multiple attack patterns, granular configuration, and monitoring for authorized security assessments.
- CVE_2023_44487-Rapid_ResetExploit
A comprehensive Python testing tool for CVE-2023-44487, the HTTP/2 Rapid Reset vulnerability. This enhanced version provides granular control over testing parameters, multiple attack patterns, and advanced monitoring capabilities.
HTTP/2 Rapid Reset Exploit PoC
Examples for Implementing cve-2023-44487 ( HTTP/2 Rapid Reset Attack ) Concept
PoC for HTTP/2 Rapid Reset DDoS Vulnerability - CVE-2023-44487
- CVE-2023-44487Exploit
A python based exploit to test out rapid reset attack (CVE-2023-44487)
Proof-of-concept checker for CVE-2023-44487 HTTP/2 Rapid Reset DoS vulnerability. Tests single or bulk URLs for RST_STREAM frame susceptibility with CSV/TXT/XLSX output.
- cve-2023-44487-demoResearch
Demo for detection and mitigation of HTTP/2 Rapid Reset vulnerability (CVE-2023-44487)
- CVE-2023-44487Scanner
Non-invasive HTTP/2 vulnerability scanner for CVE-2023-44487 that detects exploitable stream reset conditions by testing protocol downgrade and connection stream behavior.
Testing resources and attacker tool for CVE-2023-44487 (HTTP/2 Rapid Reset) to evaluate server resilience across Go, gRPC, reverse proxy, and nginx configurations.
- CVE-2023-44487Exploit
RapidResetClient
Test Script for CVE-2023-44487
PoC script for HTTP/2 Rapid Reset (CVE-2023-44487) that sends crafted HTTP/2 streams to trigger denial-of-service conditions on vulnerable servers, reverse proxies, and load balancers.
- nice-cve-pocPoC
A collection of CVE Proof of concepts
- CVE-2023-44487-Exploit
Go-based exploit for CVE-2023-44487 (HTTP/2 Rapid Reset) enabling high-rate denial-of-service attacks against vulnerable web servers with configurable request count.
PoC for CVE-2023-44487 ( HTTP/2 Rapid Reset Attack ) Concept
poc for the rst dos attack discovered in 2023
Proof-of-concept for CVE-2023-44487, demonstrating the HTTP/2 rapid reset denial-of-service vulnerability.
CVE proof-of-concept labs, exploit scripts, and detection/prevention rules (Nginx, Apache, Snort, YARA) for high-severity CVEs. Authorized security testing & research only.
Este PoC permite determinar si un servidor Nginx en su versión 1.22.1 es vulnerable a ciertas vulnerabilidades conocidas
CVE-2025-25063 MadeYouReset HTTP/2 DDoS
- rapidresetPoC
CVE-2023-44487
Madhusudhan Rajappa · multiple · Sep 16, 2025
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.