### Vulnerability Details Details of attacks exploiting the HTTP/2 protocol Denial of Service vulnerability (CVE-2023-44487) have been publicly disclosed online in recent months. Malicious attackers can bypass concurrent stream limits by opening multiple request streams and immediately canceling them via RST_STREAM frames, leading to rapid exhaustion of server resources. Given that this vulnerability affects a wide range of products and has been actively exploited in the wild, customers are advised to perform self-inspections and implement protective measures as soon as possible. ### Affected Scope | Software | Affected Versions | |---|---| | Netty | Netty < 4.1.100.Final | | Go | Go < 1.21.3 | | | Go < 1.20.10 | | Apache Tomcat | 11.0.0-M1 <= Apache Tomcat <= 11.0.0-M11 | | | 10.1.0-M1 <= Apache Tomcat <= 10.1.13 | | | 9.0.0-M1 <= Apache Tomcat <= 9.0.80 | | | 8.5.0 <= Apache Tomcat <= 8.5.93 | | grpc-go | grpc-go < 1.58.3 | | | grpc-go < 1.57.1 | | | grpc-go < 1.56.3 | | jetty | jetty < 12.0.2 | | | jetty < 10.0.17 | | | jetty < 11.0.17 | | | jetty < 9.4.53.v20231009 | | nghttp2 | nghttp2 < v1.57.0 | | Apache Traffic Server | 8.0.0 <= Apache Traffic Server <= 8.1.8 | | | 9.0.0 <= Apache Traffic Server <= 9.2.2 | ps: *In its default configuration, Nginx allows clients to maintain a maximum of 1,000 HTTP connections, and this limit provides default protection against such attacks. However, please note that if the `keepalive_requests` value is configured significantly higher than the default, the system may also be susceptible to this vulnerability. ### Remediation **Note:** Before installing or upgrading, please ensure you have backed up your data, taken snapshots, and conducted testing to prevent unexpected issues. | Software | Fixed Version | Download | |---|---|---| | Netty | >= 4.1.100.Final | https://github.com/netty/netty/releases/tag/netty-4.1.100.Final | | Go | >= 1.21.3、1.20.10 | https://github.com/golang/go/tags | | Apache Tomcat | >= 11.0.0-M12、10.1.14、9.0.81、8.5.94 | https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12 | | | | https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14 | | | | https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81 | | | | https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94 | | grpc-go | >= 1.58.3、1.57.1、1.56.3 | https://github.com/grpc/grpc-go/releases | | jetty | >= 12.0.2、10.0.17、11.0.17、9.4.53.v20231009 | https://github.com/eclipse/jetty.project/releases | | nghttp2 | >= v1.57.0 | https://github.com/nghttp2/nghttp2/releases | | Apache Traffic Server | >= 8.1.9、9.2.3 | https://github.com/apache/trafficserver/tags | | NGINX | | https://github.com/nginx/nginx | ### Mitigations - Enable UCloud security products [Web Application Firewall UWAF](https://www.ucloud.cn/site/product/uewaf.html), [DDoS Attack Protection](https://www.ucloud.cn/site/product/uddos.html), and [UClean](https://docs.ucloud.cn/uantiddos/uclean/index); - Avoid fully exposing applications to the public internet; - Disable the HTTP/2 protocol on web services (note that this may impact system performance); ### Reference Links [https://seclists.org/oss-sec/2023/q4/75](https://seclists.org/oss-sec/2023/q4/75) [https://www.openwall.com/lists/oss-security/2023/10/10/6](https://www.openwall.com/lists/oss-security/2023/10/10/6) [https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/](https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/)

UCloud-202310-003:HTTP/2 Protocol Denial of Service Vulnerability Security Advisory