GHSA-xpw8-rcwv-8f8p

Dashboard / Vulnerabilities / GHSA-xpw8-rcwv-8f8p

GHSA-xpw8-rcwv-8f8p

Summary: io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack

Details: A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack. ### Impact This is a DDOS attack, any http2 server is affected and so you should update as soon as possible. ### Patches This is patched in version 4.1.100.Final. ### Workarounds A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own `Http2FrameListener` implementation or an `ChannelInboundHandler` implementation (depending which http2 API is used). ### References - https://www.cve.org/CVERecord?id=CVE-2023-44487 - https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ - https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

References: https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3, https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p, https://nvd.nist.gov/vuln/detail/CVE-2023-44487, https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61, https://github.com/netty/netty, https://www.cve.org/CVERecord?id=CVE-2023-44487