Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 13 Oct 2023 19:32:28 +0200
From: Steffen Nurpmeso <>
Subject: Re: CVE-2023-44487: HTTP/2 Rapid Reset attack
 against many implementations

Jonathan Wright wrote in

[i resort a bit]

 |On Tue, Oct 10, 2023 at 2:23 PM Moritz Muehlenhoff <> wrote:
 |> On Tue, Oct 10, 2023 at 11:40:06AM -0700, Alan Coopersmith wrote:
 |>> Information I've found so far on open source implementations (most via
 |> the
 |>> current listings in the CVE) include:
 |> Apache Trafficserver is also affected:

 |OpenLitespeed is not impacted:

It did not really surprise me that Glenn Strauss, the wonderful
developer of the lighttpd that i use for eight years, had to go
like this (i hope he does not mind i quote #lighttpd here):

  01:45 < gps> [..]No, I did not have prior knowledge.
  02:20 < gps> Confirmed: while all web servers implementing
    HTTP/2 are exposed to the attack in CVE-2023-44487, the way each
    web server software processes HTTP/2 affects the size of the
    impact of the attack.  With lighttpd, the impact is largely
    limited to the CPU usage parsing the HTTP/2 HEADERS frame,
    including HPACK decoding.
  03:58 < gps> To be clear, the attack still causes lighttpd to
    use more resources, but the amplification of resource
    commitment is constrained in lighttpd due to the design
    choices made for lighttpd HTTP/2.

|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.