GHSA-XPW8-RCWV-8F8P

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.

Workarounds

A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own Http2FrameListener implementation or an ChannelInboundHandler implementation (depending which http2 API is used).

References

• https://www.cve.org/CVERecord?id=CVE-2023-44487
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.

Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.

GHSA-XPW8-RCWV-8F8P has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (4.1.100.Final); upgrading removes the vulnerable code path.

Kodem intelligence

This is patched in version 4.1.100.Final.

1. What is GHSA-XPW8-RCWV-8F8P? GHSA-XPW8-RCWV-8F8P is a high-severity uncontrolled resource consumption vulnerability in io.netty:netty-codec-http2 (maven), affecting versions < 4.1.100.Final. It is fixed in 4.1.100.Final. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
2. How severe is GHSA-XPW8-RCWV-8F8P? GHSA-XPW8-RCWV-8F8P has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of io.netty:netty-codec-http2 are affected by GHSA-XPW8-RCWV-8F8P? io.netty:netty-codec-http2 (maven) versions < 4.1.100.Final is affected.
4. Is there a fix for GHSA-XPW8-RCWV-8F8P? Yes. GHSA-XPW8-RCWV-8F8P is fixed in 4.1.100.Final. Upgrade to this version or later.
5. Is GHSA-XPW8-RCWV-8F8P exploitable, and should I be worried? Whether GHSA-XPW8-RCWV-8F8P is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-XPW8-RCWV-8F8P is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-XPW8-RCWV-8F8P? Upgrade io.netty:netty-codec-http2 to 4.1.100.Final or later.