GHSA-xpw8-rcwv-8f8p
io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack
Quick fix
GHSA-xpw8-rcwv-8f8p — io.netty:netty-codec-http2: upgrade to the fixed version with the command below.
# pom.xml: bump <version>4.1.100.Final</version> for io.netty:netty-codec-http2Details
A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.
### Impact This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.
### Patches This is patched in version 4.1.100.Final.
### Workarounds A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own `Http2FrameListener` implementation or an `ChannelInboundHandler` implementation (depending which http2 API is used).
### References - https://www.cve.org/CVERecord?id=CVE-2023-44487 - https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ - https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 4.1.100.Final# pom.xml: bump <version>4.1.100.Final</version> for io.netty:netty-codec-http2References
- https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3[WEB]
- https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2023-44487[ADVISORY]
- https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61[WEB]
- https://github.com/netty/netty[PACKAGE]
- https://www.cve.org/CVERecord?id=CVE-2023-44487[WEB]