PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-44487 IETF CVE debrief

CVE-2023-44487 is a high-severity HTTP/2 issue that CISA added to its Known Exploited Vulnerabilities catalog on 2023-10-10, indicating active exploitation. The KEV record sets a remediation due date of 2023-10-31 and directs defenders to apply vendor mitigations, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Organizations that rely on HTTP/2-facing services or products should treat this as an urgent mitigation and verification task.

Vendor
IETF
Product
HTTP/2
CVSS
HIGH 7.5
CISA KEV
Listed
Original CVE published
2023-10-10
Original CVE updated
2023-10-10
Advisory published
2023-10-10
Advisory updated
2023-10-10

Who should care

Security, operations, and platform teams running internet-facing HTTP/2 services; cloud service owners subject to BOD 22-01; and product teams that embed or depend on HTTP/2 components.

Technical summary

The supplied corpus identifies the issue as the "HTTP/2 Rapid Reset Attack Vulnerability" associated with IETF HTTP/2 and marks it as a known-exploited vulnerability. The corpus does not provide deeper mechanics, so this summary stays at the official-record level: a high-severity HTTP/2 vulnerability requiring prompt mitigation, and potentially service discontinuation if no mitigation exists.

Defensive priority

Immediate. CISA added the CVE to KEV on the publication date and set a 2023-10-31 due date, so this should be prioritized ahead of routine patch queues.

Recommended defensive actions

  • Confirm whether any exposed services, products, or managed cloud offerings in your environment use HTTP/2.
  • Apply vendor-provided mitigations as soon as they are available.
  • For cloud services, follow applicable BOD 22-01 guidance.
  • If a mitigation is unavailable, discontinue use of the affected product or service.
  • Track remediation against the CISA KEV due date and verify completion.
  • Monitor official vendor, CISA, CVE.org, and NVD records for updates.

Evidence notes

This debrief is based on the supplied CISA KEV source item and official record links only. The source item records vendorProject=IETF, product=HTTP/2, vulnerabilityName="HTTP/2 Rapid Reset Attack Vulnerability", dateAdded=2023-10-10, dueDate=2023-10-31, knownRansomwareCampaignUse=Unknown, and the required action text to apply mitigations, follow BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.

Official resources

CVE published and modified: 2023-10-10T00:00:00.000Z. CISA KEV date added: 2023-10-10; due date: 2023-10-31. This debrief uses the CVE publication date and KEV timeline for context.