The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
{ "vanir_signatures": [ { "target": { "file": "solr/solrj-zookeeper/src/java/org/apache/solr/common/cloud/ClusterProperties.java" }, "source": "https://github.com/apache/solr/commit/71e101bb37497f730078d9afe1991b60d10bfe96", "deprecated": false, "digest": { "line_hashes": [ "328392780327022616232592932747945111915", "237657762462344934055526225808371591655", "323800155442678667737596367194170243812", "290062371794872308484858904222114607176" ], "threshold": 0.9 }, "id": "CVE-2023-44487-1d75e3ae", "signature_type": "Line", "signature_version": "v1" }, { "target": { "file": "codec-http2/src/main/java/io/netty/handler/codec/http2/AbstractHttp2ConnectionHandlerBuilder.java" }, "source": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61", "deprecated": false, "digest": { "line_hashes": [ "125653841197755015383824085277395303348", "90418587286054842174517546781689668578", "151242893358356810592204537174328377728", "39893465424968585855307447200384440857", "255665036340097661680623602812006508047", "175832492354488066379649821142738785749", "217820127006468297893954384014110769203", "45503679288625033659896703612419790998", "203678239741338965265560476255201408556", "26647441025014002737278366428472284756", "214268563287895355931266018920676640314", "326725953729396929244827591844043620568", "287743702612693595655651666470853231804", "280682175060858981970542351060069250410", "164882572200281737650816636634160836745", "135745700086611110039446803415426203221", "184478615219231105271671502653528822815" ], "threshold": 0.9 }, "id": "CVE-2023-44487-316dc442", "signature_type": "Line", "signature_version": "v1" }, { "target": { "file": "codec-http2/src/test/java/io/netty/handler/codec/http2/Http2EmptyDataFrameConnectionDecoderTest.java" }, "source": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61", "deprecated": false, "digest": { "line_hashes": [ "16735128250395063398141887077049053742", "65294614127459941946307055286129098191", "277430768673836084511343809579198895862", "103372399134332054939248432284104540540", "238798030421717051437763159167025399488", "81096357800483170626125468848033922878", "153804175243775834163807606123820043951", "52521870671296124989521093171926806498", "194005468057387631812701794470237768011", "333700852061655906066052207224633564228", "304845782338742972530716022272444441953", "271236924675914146234721144301392245446", "78269309098620982866867106289155000969", "288885498558228198286238179279824487251", "73653074389916922318080804193917209741", "125412958094124814796670713864970374852", "172435094042166061091601672582797746991", "125333170306924586976060012907004280044", "338143110237770229409247235671510195847", "32438289396276550613948674520925674990", "28199600148976914439998831223350748650", "320386303651994676700322115949793400166", "339173214183602301590023767829271839521", "76556667333872069465724770437751404723", "9401768708171708196925050928953207314", "4688725266895228616458641659678759166", "57063629870321924651018731012497520992", "154920922165130022281584794232586234094", "86042005517765526587370047814600680586", "52342039113735602673964372912217535750", "329491445113934849905435327340288555755", "177185184524246663766121475782238307307", "267227223180714821027068557741028826827", "66216846262297558993246968303090113125", "232634522799228696895558487346169934959", "76586462288042028935997856620061239150" ], "threshold": 0.9 }, "id": "CVE-2023-44487-396bc60a", "signature_type": "Line", "signature_version": "v1" }, { "target": { "function": "buildFromCodec", "file": "codec-http2/src/main/java/io/netty/handler/codec/http2/AbstractHttp2ConnectionHandlerBuilder.java" }, "source": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61", "deprecated": false, "digest": { "function_hash": "201182205581498582350704174032005350866", "length": 513.0 }, "id": "CVE-2023-44487-4dcf71aa", "signature_type": "Function", "signature_version": "v1" }, { "target": { "file": "core/src/main/java/hudson/PluginWrapper.java" }, "source": "https://github.com/jenkinsci/jenkins/commit/2a9197d36dcd544b94ea2b5e2057a6bcb15552fc", "deprecated": false, "digest": { "line_hashes": [ "160369367981837376425211771792483086401", "101618438663106186646298048711112475647", "242886222244956186828174638259471718995", "298934149985755588273261426844349629368" ], "threshold": 0.9 }, "id": "CVE-2023-44487-52d02347", "signature_type": "Line", "signature_version": "v1" }, { "target": { "file": "core/src/main/java/io/grpc/internal/GrpcUtil.java" }, "source": "https://github.com/grpc/grpc-java/commit/cde208afce38186d06084605abed36f21b003465", "deprecated": false, "digest": { "line_hashes": [ "2924417680346057517451287411494500332", "37797666818819677617006618606516495288", "12395536377597138516843557228060535552", "298354614495450435063552769147508739246" ], "threshold": 0.9 }, "id": "CVE-2023-44487-5ecacf74", "signature_type": "Line", "signature_version": "v1" }, { "target": { "function": "testDecoration", "file": "codec-http2/src/test/java/io/netty/handler/codec/http2/Http2EmptyDataFrameConnectionDecoderTest.java" }, "source": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61", "deprecated": false, "digest": { "function_hash": "75416424745415690959836396218773344287", "length": 645.0 }, "id": "CVE-2023-44487-62d37ea7", "signature_type": "Function", "signature_version": "v1" }, { "target": { "file": "codec-http2/src/main/java/io/netty/handler/codec/http2/Http2FrameCodecBuilder.java" }, "source": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61", "deprecated": false, "digest": { "line_hashes": [ "33134734909587663339818629659976090823", "272048144275268619834493568780310487596", "224826635466754118933900601091791444299" ], "threshold": 0.9 }, "id": "CVE-2023-44487-662b95ca", "signature_type": "Line", "signature_version": "v1" }, { "target": { "file": "solr/core/src/java/org/apache/solr/cloud/ZkCLI.java" }, "source": "https://github.com/apache/solr/commit/71e101bb37497f730078d9afe1991b60d10bfe96", "deprecated": false, "digest": { "line_hashes": [ "96458608783253083586626325045805789884", "145522882445360041683055852128286161144", "309931195073256237902336501619192928175", "13386222136100787363592435200166865262", "96458608783253083586626325045805789884", "145522882445360041683055852128286161144", "42204928388511559801424355220728707911", "222015197229070154472973636937113480309" ], "threshold": 0.9 }, "id": "CVE-2023-44487-adbbd0dc", "signature_type": "Line", "signature_version": "v1" }, { "target": { "file": "codec-http2/src/main/java/io/netty/handler/codec/http2/Http2MultiplexCodecBuilder.java" }, "source": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61", "deprecated": false, "digest": { "line_hashes": [ "180662945750400519118145642308779674614", "62306042824350136150524994252417120434", "188854520484551783617200803370691804218" ], "threshold": 0.9 }, "id": "CVE-2023-44487-b2682bbf", "signature_type": "Line", "signature_version": "v1" }, { "target": { "function": "testDecorationWithNull", "file": "codec-http2/src/test/java/io/netty/handler/codec/http2/Http2EmptyDataFrameConnectionDecoderTest.java" }, "source": "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61", "deprecated": false, "digest": { "function_hash": "223971630053580329111965032198166109919", "length": 159.0 }, "id": "CVE-2023-44487-d6d21cf1", "signature_type": "Function", "signature_version": "v1" }, { "target": { "function": "getBackupVersion", "file": "core/src/main/java/hudson/PluginWrapper.java" }, "source": "https://github.com/jenkinsci/jenkins/commit/2a9197d36dcd544b94ea2b5e2057a6bcb15552fc", "deprecated": false, "digest": { "function_hash": "111592541090635675244417697061068730864", "length": 370.0 }, "id": "CVE-2023-44487-e61c2465", "signature_type": "Function", "signature_version": "v1" } ] }