Critical HTTP/2 Vulnerability CVE-2023-44487 Lets Attackers Crash Servers

Key Takeaways

• A critical denial-of-service vulnerability, tracked as CVE-2023-44487, has been discovered in various HTTP/2 implementations.
• Unauthenticated attackers can exploit this flaw to crash servers by triggering memory exhaustion through manipulated flow control.
• The vulnerability affects numerous vendors, including Apache Traffic Server, Citrix, F5 Networks, Meta, Red Hat, SUSE, and Yahoo.
• Patches and mitigation strategies are being released, emphasizing the need for immediate updates and proactive monitoring.

Severe HTTP/2 Flaw Threatens Web Servers with Denial-of-Service Attacks

A significant denial-of-service (DoS) vulnerability impacting HTTP/2 implementations has emerged, raising alarms across the cybersecurity landscape. This flaw, designated CVE-2023-44487, allows unauthenticated attackers to render vulnerable servers inoperable by exploiting specific conditions that lead to memory exhaustion.

The core of the problem lies in how various HTTP/2 server implementations handle resource consumption when confronted with deliberately stalled data flows. Attackers can leverage this weakness to degrade or completely disrupt services, posing a substantial threat to web infrastructure.

Understanding the HTTP/2 Protocol and the Flaw

HTTP/2, formally defined in RFC 9113, is a foundational protocol for modern web performance, offering enhancements like multiplexing, header compression, and sophisticated flow control mechanisms. Flow control is particularly crucial; it’s designed to prevent either endpoint from being overwhelmed by limiting the amount of data transmitted before an acknowledgment is received.

However, this very mechanism becomes an attack vector when improperly implemented. The vulnerability arises when a malicious client intentionally manipulates HTTP/2 flow-control parameters. This can involve setting the SETTINGS_INITIAL_WINDOW_SIZE to zero or withholding WINDOW_UPDATE frames, effectively preventing the server from sending response data back to the client.

In vulnerable server implementations, even though the server cannot transmit its responses, it continues to process incoming requests and generate full response data. According to CERT/CC, this response data accumulates in memory buffers for each stalled stream. An attacker can then rapidly deplete server memory by opening multiple such streams and requesting large resources. This process continues until connections time out or are forcefully terminated by the system.

This behavior leads to a “memory amplification” effect, where relatively small requests from an attacker result in a disproportionately large consumption of server memory. Researchers from the Okta Red Team, who initially reported this issue, demonstrated that the attack can be executed remotely without any authentication. In environments with ample resources, this can trigger severe outcomes such as out-of-memory conditions, kernel OOM kills, or intense swap thrashing, potentially making systems completely unresponsive.

Even in more resource-constrained configurations, attackers can exhaust critical resources like worker threads or connection pools, effectively blocking legitimate users from accessing services.

Widespread Impact and Vendor Response

The vulnerability has been assigned multiple CVEs, including CVE-2026-44909, CVE-2026-59173, and CVE-2026-59762, reflecting its broad impact across various vendors and their respective HTTP/2 implementations. Affected organizations include prominent names such as Apache Traffic Server, Citrix, F5 Networks, Meta, Red Hat, SUSE, and Yahoo. Conversely, some providers like Cloudflare and AMD have confirmed that their systems are not susceptible to this specific flaw.

This incident underscores a recurring theme in cybersecurity: protocol-level features, designed for legitimate purposes, can be weaponized for denial-of-service attacks. Unlike traditional volumetric DDoS attacks, which rely on overwhelming bandwidth, this technique exploits protocol abuse and efficient resource exhaustion, making it more challenging to detect with conventional traffic filtering mechanisms.

Vendors have begun the process of releasing patches and providing mitigation guidance. Recommended defenses include implementing strict memory limits for buffered responses, capping the number of concurrent HTTP/2 streams per connection, and proactively terminating connections that exhibit stalled flow-control behavior. Robust timeout handling and appropriate backpressure mechanisms are also crucial in reducing exposure to this vulnerability.

What You Should Do

• Apply Vendor Patches Immediately: Review advisories from your HTTP/2 service vendors and apply all available security updates as a top priority.
• Implement Memory Limits: Configure strict memory limits for buffered responses on your HTTP/2 servers to prevent memory amplification.
• Limit Concurrent Streams: Enforce limits on the number of concurrent HTTP/2 streams allowed per connection to mitigate the impact of malicious stream creation.
• Monitor for Abnormal Behavior: Actively monitor for unusual memory usage patterns, excessive connection timeouts, and atypical HTTP/2 stream behavior that could indicate an ongoing attack.
• Configure Timeouts and Backpressure: Ensure proper timeout handling and backpressure mechanisms are in place to manage stalled connections and prevent resource exhaustion.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.