{"id":"GHSA-vx74-f528-fxqg","aliases":[],"status":"published","title":"github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset","description":"### Impact\n\nRapidly creating and cancelling streams (HEADERS frame immediately followed by RST_STREAM) without bound cause denial of service.\n\nSee https://www.cve.org/CVERecord?id=CVE-2023-44487 for details.\n\n### Patches\n\nnghttp2 v1.57.0 mitigates this vulnerability by default.\n\n### Workarounds\n\nIf upgrading to nghttp2 v1.57.0 is not possible, implement `nghttp2_on_frame_recv_callback`, and check and count RST_STREAM frames.  If excessive number of RST_STREAM are received, then take action, such as dropping connection silently, or call `nghttp2_submit_goaway` and gracefully terminate the connection.\n\n### References\n\nThe following commit mitigates this vulnerability:\n\n- https://github.com/nghttp2/nghttp2/commit/72b4af6143681f528f1d237b21a9a7aee1738832","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2023-10-10T18:23:21Z","modified":"2026-02-04T03:53:56Z","fixes":[{"ecosystem":"Go","package":"github.com/nghttp2/nghttp2","fixed_in":["1.57.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/nghttp2/nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.57.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/nghttp2/nghttp2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.57.0"}]}]}],"references":[{"url":"https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg","tags":["web"]},{"url":"https://github.com/nghttp2/nghttp2/commit/72b4af6143681f528f1d237b21a9a7aee1738832","tags":["web"]},{"url":"https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vx74-f528-fxqg"},{"url":"https://github.com/nghttp2/nghttp2","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-vx74-f528-fxqg","title":"github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset","description":"### Impact\n\nRapidly creating and cancelling streams (HEADERS frame immediately followed by RST_STREAM) without bound cause denial of service.\n\nSee https://www.cve.org/CVERecord?id=CVE-2023-44487 for details.\n\n### Patches\n\nnghttp2 v1.57.0 mitigates this vulnerability by default.\n\n### Workarounds\n\nIf upgrading to nghttp2 v1.57.0 is not possible, implement `nghttp2_on_frame_recv_callback`, and check and count RST_STREAM frames.  If excessive number of RST_STREAM are received, then take action, such as dropping connection silently, or call `nghttp2_submit_goaway` and gracefully terminate the connection.\n\n### References\n\nThe following commit mitigates this vulnerability:\n\n- https://github.com/nghttp2/nghttp2/commit/72b4af6143681f528f1d237b21a9a7aee1738832\n","status":"published","published":"2023-10-10T18:23:21Z","modified":"2023-10-10T18:23:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:08.847568Z"}],"osv":[{"id":"GHSA-vx74-f528-fxqg","title":"github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset","description":"### Impact\n\nRapidly creating and cancelling streams (HEADERS frame immediately followed by RST_STREAM) without bound cause denial of service.\n\nSee https://www.cve.org/CVERecord?id=CVE-2023-44487 for details.\n\n### Patches\n\nnghttp2 v1.57.0 mitigates this vulnerability by default.\n\n### Workarounds\n\nIf upgrading to nghttp2 v1.57.0 is not possible, implement `nghttp2_on_frame_recv_callback`, and check and count RST_STREAM frames.  If excessive number of RST_STREAM are received, then take action, such as dropping connection silently, or call `nghttp2_submit_goaway` and gracefully terminate the connection.\n\n### References\n\nThe following commit mitigates this vulnerability:\n\n- https://github.com/nghttp2/nghttp2/commit/72b4af6143681f528f1d237b21a9a7aee1738832\n","status":"published","published":"2023-10-10T18:23:21Z","modified":"2026-02-04T03:53:56.288506Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:57.694388Z"}]}}