CVE-2023-44487
HTTP/2 Rapid Reset attack leading to Denial of Service across web servers
⚡ KEV — Known Exploited
CVSS 7.5 (High)
EPSS 0.8910 (1th pct)
Technical Description
HTTP/2 Rapid Reset attack leading to Denial of Service across web servers.
Why this matters to your organisation:
The organisation uses nginx, which is affected by CVE-2023-44487. CISA has confirmed active exploitation in the wild (KEV catalogue entry). The Exploit Prediction Scoring System (EPSS) estimates a 89.1% probability of exploitation within 30 days. The affected service is internet-facing, increasing exposure. This is a critical service for the organisation.
The organisation uses nginx, which is affected by CVE-2023-44487. CISA has confirmed active exploitation in the wild (KEV catalogue entry). The Exploit Prediction Scoring System (EPSS) estimates a 89.1% probability of exploitation within 30 days. The affected service is internet-facing, increasing exposure. This is a critical service for the organisation.
Potential Impact
A vulnerability in nginx rated High (CVSS 7.5). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalogue, indicating it has been actively exploited in the wild.
✅ Recommended Next Action
Review the vendor advisory for CVE-2023-44487 and assess whether patching or compensating controls are appropriate for your environment. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-44487
Confidence: High
The installed version exactly matches an affected version.
CVE Details
| Product | nginx nginx |
| Version Range | <= 1.25.2 → ∞ |
| Installed | 1.24.0 |
| Match Type | Exact Match |
| CVSS | 7.5 |
| KEV | YES |
| EPSS | 0.891 |
| Source |
NVD · Oct. 10, 2023 View reference ↗ |
Score Breakdown
⚡ KEV+40
🌐 Exposure+20
⭐ Importance+15
📈 EPSS+13.4
🔢 CVSS+7.5
Total96