CVE-2023-44487: - Rapid Reset HTTP/2 vulnerability

Published Oct 9, 2023
·
Updated

HTTP/2 Rapid reset attack The HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RSTSTREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RSTSTREAM frame, before any other data from that TCP connection is processed.

Abuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RSTSTREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open.

The HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.

The ability to reset streams immediately allows each connection to have an indefinite number of requests in flight. By explicitly canceling the requests, the attacker never exceeds the limit on the number of concurrent open streams. The number of in-flight requests is no longer dependent on the round-trip time (RTT), but only on the available network bandwidth.

In a typical HTTP/2 server implementation, the server will still have to do significant amounts of work for canceled requests, such as allocating new stream data structures, parsing the query and doing header decompression, and mapping the URL to a resource. For reverse proxy implementations, the request may be proxied to the backend server before the RSTSTREAM frame is processed. The client on the other hand paid almost no costs for sending the requests. This creates an exploitable cost asymmetry between the server and the client.

Multiple software artifacts implementing HTTP/2 are affected. This advisory was originally ingested from the swift-nio-http2 repo advisory and their original conent follows.

swift-nio-http2 specific advisory swift-nio-http2 is vulnerable to a denial-of-service vulnerability in which a malicious client can create and then reset a large number of HTTP/2 streams in a short period of time. This causes swift-nio-http2 to commit to a large amount of expensive work which it then throws away, including creating entirely new Channels to serve the traffic. This can easily overwhelm an EventLoop and prevent it from making forward progress.

swift-nio-http2 1.28 contains a remediation for this issue that applies reset counter using a sliding window. This constrains the number of stream resets that may occur in a given window of time. Clients violating this limit will have their connections torn down. This allows clients to continue to cancel streams for legitimate reasons, while constraining malicious actors.

Other sources

HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).

— CISA

MITRE: CVE-2023-44487 HTTP/2 Rapid Reset Attack

— Microsoft

NGINX has been patched to mitigate CVE-2023-44487.

— GitLab

The Fortinet Product Security team has evaluated the impact of the vulnerablity HTTP/2 Rapid Reset Attack, listed below:CVE-2023-44487:The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly.https://nvd.nist.gov/vuln/detail/CVE-2023-44487

— FortiGuard

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Affected Software

588 affected componentsFixes available
debian/netty<=1:4.1.48-7, <=1:4.1.48-4
1:4.1.48-81:4.1.48-4+deb11u21:4.1.48-7+deb12u1
Microsoft Windows Server 2016
Patch available
Microsoft Windows Server 2016
Patch available
IETF Http=2.0
nghttp2 nghttp2<1.57.0
Netty Netty<4.1.100
Envoyproxy Envoy=1.24.10
Envoyproxy Envoy=1.25.9
Envoyproxy Envoy=1.26.4
Envoyproxy Envoy=1.27.0
Eclipse Jetty<9.4.53
Eclipse Jetty>=10.0.0<10.0.17
Eclipse Jetty>=11.0.0<11.0.17
Eclipse Jetty>=12.0.0<12.0.2
caddyserver Caddy<2.7.5
Golang Go<1.20.10
Golang Go>=1.21.0<1.21.3
Golang Http2 Go<0.17.0
Golang Networking Go<0.17.0
F5 BIG-IP Access Policy Manager>=13.1.0<=13.1.5
F5 BIG-IP Access Policy Manager>=14.1.0<=14.1.5
F5 BIG-IP Access Policy Manager>=15.1.0<=15.1.10
F5 BIG-IP Access Policy Manager>=16.1.0<=16.1.4
F5 BIG-IP Access Policy Manager=17.1.0
F5 BIG-IP Advanced Firewall Manager>=13.1.0<=13.1.5
F5 BIG-IP Advanced Firewall Manager>=14.1.0<=14.1.5
F5 BIG-IP Advanced Firewall Manager>=15.1.0<=15.1.10
F5 BIG-IP Advanced Firewall Manager>=16.1.0<=16.1.4
F5 BIG-IP Advanced Firewall Manager=17.1.0
F5 Big-ip Advanced Web Application Firewall>=13.1.0<=13.1.5
F5 Big-ip Advanced Web Application Firewall>=14.1.0<=14.1.5
F5 Big-ip Advanced Web Application Firewall>=15.1.0<=15.1.10
F5 Big-ip Advanced Web Application Firewall>=16.1.0<=16.1.4
F5 Big-ip Advanced Web Application Firewall=17.1.0
F5 BIG-IP Analytics>=13.1.0<=13.1.5
F5 BIG-IP Analytics>=14.1.0<=14.1.5
F5 BIG-IP Analytics>=15.1.0<=15.1.10
F5 BIG-IP Analytics>=16.1.0<=16.1.4
F5 BIG-IP Analytics=17.1.0
F5 Big-ip Application Acceleration Manager>=13.1.0<=13.1.5
F5 Big-ip Application Acceleration Manager>=14.1.0<=14.1.5
F5 Big-ip Application Acceleration Manager>=15.1.0<=15.1.10
F5 Big-ip Application Acceleration Manager>=16.1.0<=16.1.4
F5 Big-ip Application Acceleration Manager=17.1.0
F5 BIG-IP Application Security Manager>=13.1.0<=13.1.5
F5 BIG-IP Application Security Manager>=14.1.0<=14.1.5
F5 BIG-IP Application Security Manager>=15.1.0<=15.1.10
F5 BIG-IP Application Security Manager>=16.1.0<=16.1.4
F5 BIG-IP Application Security Manager=17.1.0
F5 Big-ip Application Visibility And Reporting>=13.1.0<=13.1.5
F5 Big-ip Application Visibility And Reporting>=14.1.0<=14.1.5
F5 Big-ip Application Visibility And Reporting>=15.1.0<=15.1.10
F5 Big-ip Application Visibility And Reporting>=16.1.0<=16.1.4
F5 Big-ip Application Visibility And Reporting=17.1.0
F5 Big-ip Carrier-grade Nat>=13.1.0<=13.1.5
F5 Big-ip Carrier-grade Nat>=14.1.0<=14.1.5
F5 Big-ip Carrier-grade Nat>=15.1.0<=15.1.10
F5 Big-ip Carrier-grade Nat>=16.1.0<=16.1.4
F5 Big-ip Carrier-grade Nat=17.1.0
F5 Big-ip Ddos Hybrid Defender>=13.1.0<=13.1.5
F5 Big-ip Ddos Hybrid Defender>=14.1.0<=14.1.5
F5 Big-ip Ddos Hybrid Defender>=15.1.0<=15.1.10
F5 Big-ip Ddos Hybrid Defender>=16.1.0<=16.1.4
F5 Big-ip Ddos Hybrid Defender=17.1.0
F5 Big-ip Domain Name System>=13.1.0<=13.1.5
F5 Big-ip Domain Name System>=14.1.0<=14.1.5
F5 Big-ip Domain Name System>=15.1.0<=15.1.10
F5 Big-ip Domain Name System>=16.1.0<=16.1.4
F5 Big-ip Domain Name System=17.1.0
F5 Big-ip Fraud Protection Service>=13.1.0<=13.1.5
F5 Big-ip Fraud Protection Service>=14.1.0<=14.1.5
F5 Big-ip Fraud Protection Service>=15.1.0<=15.1.10
F5 Big-ip Fraud Protection Service>=16.1.0<=16.1.4
F5 Big-ip Fraud Protection Service=17.1.0
F5 Big-ip Global Traffic Manager>=13.1.0<=13.1.5
F5 Big-ip Global Traffic Manager>=14.1.0<=14.1.5
F5 Big-ip Global Traffic Manager>=15.1.0<=15.1.10
F5 Big-ip Global Traffic Manager>=16.1.0<=16.1.4
F5 Big-ip Global Traffic Manager=17.1.0
F5 Big-ip Link Controller>=13.1.0<=13.1.5
F5 Big-ip Link Controller>=14.1.0<=14.1.5
F5 Big-ip Link Controller>=15.1.0<=15.1.10
F5 Big-ip Link Controller>=16.1.0<=16.1.4
F5 Big-ip Link Controller=17.1.0
F5 Big-ip Local Traffic Manager>=13.1.0<=13.1.5
F5 Big-ip Local Traffic Manager>=14.1.0<=14.1.5
F5 Big-ip Local Traffic Manager>=15.1.0<=15.1.10
F5 Big-ip Local Traffic Manager>=16.1.0<=16.1.4
F5 Big-ip Local Traffic Manager=17.1.0
F5 BIG-IP Next=20.0.1
F5 Big-ip Next Service Proxy For Kubernetes>=1.5.0<=1.8.2
F5 Big-ip Policy Enforcement Manager>=13.1.0<=13.1.5
F5 Big-ip Policy Enforcement Manager>=14.1.0<=14.1.5
F5 Big-ip Policy Enforcement Manager>=15.1.0<=15.1.10
F5 Big-ip Policy Enforcement Manager>=16.1.0<=16.1.4
F5 Big-ip Policy Enforcement Manager=17.1.0
F5 BIG-IP SSL Orchestrator>=13.1.0<=13.1.5
F5 BIG-IP SSL Orchestrator>=14.1.0<=14.1.5
F5 BIG-IP SSL Orchestrator>=15.1.0<=15.1.10
F5 BIG-IP SSL Orchestrator>=16.1.0<=16.1.4
F5 BIG-IP SSL Orchestrator=17.1.0
F5 Big-ip Webaccelerator>=13.1.0<=13.1.5
F5 Big-ip Webaccelerator>=14.1.0<=14.1.5
F5 Big-ip Webaccelerator>=15.1.0<=15.1.10
F5 Big-ip Webaccelerator>=16.1.0<=16.1.4
F5 Big-ip Webaccelerator=17.1.0
F5 Big-ip Websafe>=13.1.0<=13.1.5
F5 Big-ip Websafe>=14.1.0<=14.1.5
F5 Big-ip Websafe>=15.1.0<=15.1.10
F5 Big-ip Websafe>=16.1.0<=16.1.4
F5 Big-ip Websafe=17.1.0
F5 Nginx>=1.9.5<=1.25.2
F5 NGINX Ingress Controller>=2.0.0<=2.4.2
F5 NGINX Ingress Controller>=3.0.0<=3.3.0
F5 NGINX Plus>=r25<r29
F5 NGINX Plus=r29
F5 NGINX Plus=r30
Apache Tomcat>=8.5.0<=8.5.93
Apache Tomcat>=9.0.0<=9.0.80
Apache Tomcat>=10.1.0<=10.1.13
Apache Tomcat=11.0.0-milestone1
Apache Tomcat=11.0.0-milestone10
Apache Tomcat=11.0.0-milestone11
Apache Tomcat=11.0.0-milestone2
Apache Tomcat=11.0.0-milestone3
Apache Tomcat=11.0.0-milestone4
Apache Tomcat=11.0.0-milestone5
Apache Tomcat=11.0.0-milestone6
Apache Tomcat=11.0.0-milestone7
Apache Tomcat=11.0.0-milestone8
Apache Tomcat=11.0.0-milestone9
Apple Swiftnio Http\/2 Swift<1.28.0
gRPC Grpc Go<1.56.3
gRPC Grpc Go>=1.58.0<1.58.3
gRPC Grpc Go=1.57.0
Microsoft .NET>=6.0.0<6.0.23
Microsoft .NET>=7.0.0<7.0.12
Microsoft ASP.NET Core>=6.0.0<6.0.23
Microsoft ASP.NET Core>=7.0.0<7.0.12
Microsoft Azure Kubernetes Service<2023-10-08
Microsoft Visual Studio 2022>=17.0<17.2.20
Microsoft Visual Studio 2022>=17.4<17.4.12
Microsoft Visual Studio 2022>=17.6<17.6.8
Microsoft Visual Studio 2022>=17.7<17.7.5
Microsoft Windows 10 1607<10.0.14393.6351
Microsoft Windows 10 1607<10.0.14393.6351
Microsoft Windows 10 1809<10.0.17763.4974
Microsoft Windows 10 21h2<10.0.19044.3570
Microsoft Windows 10 22h2<10.0.19045.3570
Microsoft Windows 11 21h2<10.0.22000.2538
Microsoft Windows 11 22h2<10.0.22621.2428
Microsoft Windows Server 2016
Microsoft Windows Server 2019
Microsoft Windows Server 2022
Nodejs Node.js<21.0.0
Microsoft Cbl-mariner<2023-10-11
Dena H2o<2023-10-10
Facebook Proxygen<2023.10.16.00
Apache APISIX<3.6.1
Apache Traffic Server>=8.0.0<8.1.9
Apache Traffic Server>=9.0.0<9.2.3
Amazon Opensearch Data Prepper<2.5.0
Debian Debian Linux=10.0
Debian Debian Linux=11.0
Debian Debian Linux=12.0
Kazu-yamamoto Http2<4.2.2
Istio Istio<1.17.6
Istio Istio>=1.18.0<1.18.3
Istio Istio>=1.19.0<1.19.1
Varnish Cache Project Varnish Cache<2023-10-10
Traefik traefik<2.10.5
Traefik traefik=3.0.0-beta1
Traefik traefik=3.0.0-beta2
Traefik traefik=3.0.0-beta3
projectcontour Contour Kubernetes<2023-10-11
Linkerd Linkerd>=2.12.0<=2.12.5
Linkerd Linkerd=2.13.0
Linkerd Linkerd=2.13.1
Linkerd Linkerd=2.14.0
Linkerd Linkerd=2.14.1
linecorp armeria<1.26.0
redhat 3scale Api Management Platform=2.0
redhat Advanced Cluster Management For Kubernetes=2.0
redhat Advanced Cluster Security=3.0
redhat Advanced Cluster Security=4.0
redhat Ansible Automation Platform=2.0
redhat Build Of Optaplanner=8.0
redhat Build Of Quarkus
redhat Ceph Storage=5.0
redhat Cert-manager Operator For Red Hat Openshift
redhat Certification For Red Hat Enterprise Linux=8.0
redhat Certification For Red Hat Enterprise Linux=9.0
redhat Cost Management
redhat Cryostat=2.0
redhat Decision Manager=7.0
redhat Fence Agents Remediation Operator
redhat Integration Camel For Spring Boot
redhat Integration Camel K
redhat Integration Service Registry
redhat JBoss A-MQ=7
redhat Jboss A-mq Streams
redhat JBoss Core Services
redhat Jboss Data Grid=7.0.0
redhat JBoss Enterprise Application Platform=6.0.0
redhat JBoss Enterprise Application Platform=7.0.0
redhat Jboss Fuse=6.0.0
redhat Jboss Fuse=7.0.0
redhat Logging Subsystem For Red Hat Openshift
redhat Machine Deletion Remediation Operator
redhat Migration Toolkit For Applications=6.0
redhat Migration Toolkit For Containers
redhat Migration Toolkit For Virtualization
redhat Network Observability Operator
redhat Node Healthcheck Operator
redhat Node Maintenance Operator
redhat Openshift Aws
redhat Openshift Api For Data Protection
redhat OpenShift Container Platform=4.0
redhat Openshift Container Platform Assisted Installer
redhat Openshift Data Science
redhat Openshift Dev Spaces
redhat Openshift Developer Tools And Services
redhat Openshift Distributed Tracing
redhat Openshift Gitops
redhat Openshift Pipelines
redhat Openshift Sandboxed Containers
redhat Openshift Secondary Scheduler Operator
redhat Openshift Serverless
redhat Openshift Service Mesh=2.0
redhat Openshift Virtualization=4
redhat Openstack Platform=16.1
redhat Openstack Platform=16.2
redhat Openstack Platform=17.1
redhat Process Automation=7.0
redhat Quay=3.0.0
redhat Run Once Duration Override Operator
redhat Satellite=6.0
redhat Self Node Remediation Operator
redhat Service Interconnect=1.0
redhat Single Sign-on=7.0
redhat Support For Spring Boot
redhat Web Terminal
redhat Enterprise Linux=6.0
redhat Enterprise Linux=8.0
redhat Enterprise Linux=9.0
redhat Service Telemetry Framework=1.5
redhat Enterprise Linux=8.0
Fedoraproject Fedora=38
NetApp Astra Control Center
Akka Http Server<10.5.3
konghq Kong Gateway<3.4.2
Microsoft Windows Server 2019
Patch available
Microsoft Windows Server 2019
Patch available
Microsoft Windows 11=22H2
Patch available
Microsoft Windows 11=22H2
Patch available
Microsoft Windows 11=21H2
Patch available
Microsoft Windows 11=21H2
Patch available
Microsoft Windows Server 2022
Patch available
Microsoft Windows Server 2022
Patch available
Microsoft Windows 10=1809
Patch available
Microsoft Windows 10=1809
Patch available
Microsoft Windows 10=1809
Patch available
Microsoft Windows 10=22H2
Patch available
Microsoft Windows 10=22H2
Patch available
Microsoft Windows 10=22H2
Patch available
Microsoft Windows 10=1607
Patch available
Microsoft Windows 10=1607
Patch available
Microsoft Windows 10=21H2
Patch available
Microsoft Windows 10=21H2
Patch available
Microsoft Windows 10=21H2
Patch available
Fortinet FortiOS>=7.4.0<=7.4.1
Fortinet FortiOS>=7.2.0<=7.2.7
Fortinet FortiOS>=7.0.0<=7.0.13
Fortinet FortiProxy>=7.4.0<=7.4.1
Fortinet FortiProxy>=7.2.0<=7.2.7
Fortinet FortiProxy>=7.0
IETF HTTP/2
maven/org.apache.tomcat:tomcat-coyote>=8.5.0<8.5.94
8.5.94
maven/org.apache.tomcat:tomcat-coyote>=9.0.0<9.0.81
9.0.81
maven/org.apache.tomcat:tomcat-coyote>=10.0.0<10.1.14
10.1.14
maven/org.apache.tomcat:tomcat-coyote>=11.0.0-M1<11.0.0-M12
11.0.0-M12
maven/com.typesafe.akka:akka-http-core_2.11<=10.1.15
maven/com.typesafe.akka:akka-http-core_2.12<10.5.3
10.5.3
maven/com.typesafe.akka:akka-http-core_2.13<10.5.3
10.5.3
maven/com.typesafe.akka:akka-http-core<10.5.3
10.5.3
maven/org.eclipse.jetty.http2:jetty-http2-server>=12.0.0<12.0.2
12.0.2
maven/org.eclipse.jetty.http2:jetty-http2-common>=12.0.0<12.0.2
12.0.2
maven/org.eclipse.jetty.http2:http2-server>=11.0.0<11.0.17
11.0.17
maven/org.eclipse.jetty.http2:http2-server>=10.0.0<10.0.17
10.0.17
maven/org.eclipse.jetty.http2:http2-server>=9.3.0<9.4.53
9.4.53
maven/org.eclipse.jetty.http2:http2-common>=11.0.0<11.0.17
11.0.17
maven/org.eclipse.jetty.http2:http2-common>=10.0.0<10.0.17
10.0.17
maven/org.eclipse.jetty.http2:http2-common>=9.3.0<9.4.53
9.4.53
swift/github.com/apple/swift-nio-http2<1.28.0
1.28.0
maven/org.apache.tomcat.embed:tomcat-embed-core>=8.5.0<8.5.94
8.5.94
maven/org.apache.tomcat.embed:tomcat-embed-core>=9.0.0<9.0.81
9.0.81
maven/org.apache.tomcat.embed:tomcat-embed-core>=10.0.0<10.1.14
10.1.14
maven/org.apache.tomcat.embed:tomcat-embed-core>=11.0.0-M1<11.0.0-M12
11.0.0-M12
go/google.golang.org/grpc<1.56.3
1.56.3
go/google.golang.org/grpc>=1.57.0<1.57.1
1.57.1
go/google.golang.org/grpc>=1.58.0<1.58.3
1.58.3
go/golang.org/x/net<0.17.0
0.17.0
F5 BIG-IP Next=20.0.1
20.1.0
F5 BIG-IP Next SPK>=1.5.0<=1.9.2
2.0.0
F5 BIG-IP>=17.1.0<=17.1.1
17.1.1.3
F5 BIG-IP>=16.1.0<=16.1.4
16.1.4.3
F5 BIG-IP>=15.1.0<=15.1.10
15.1.10.4
F5 BIG-IP>=14.1.0<=14.1.5
F5 BIG-IP>=13.1.0<=13.1.5
F5 NGINX Plus=25
30
F5 NGINX Open Source>=1.9.5<=1.25.2
F5 NGINX Ingress Controller>=3.0.0<=3.3.0
3.3.1
F5 NGINX Ingress Controller>=2.0.0<=2.4.2
F5 NGINX Ingress Controller=1.12.2
IBM InfoSphere Data Architect<=9.2.1
All of the following
Siemens Simatic S7-1500 Cpu 1518f-4 Pn\/dp Mfp Firmware>=3.1.5
Siemens Simatic S7-1500 Cpu 1518f-4 Pn\/dp Mfp
Siemens Sinec Ins<1.0
Siemens Sinec Ins=1.0
Siemens Sinec Ins=1.0-sp1
Siemens Sinec Ins=1.0-sp2
Siemens Sinec Ins=1.0-sp2_update_1
Siemens Sinec Ins=1.0-sp2_update_2
Siemens SINEC NMS<3.0
Siemens St7 Scadaconnect<1.1
All of the following
Siemens Ruggedcom Ape1808 Firmware
Siemens Ruggedcom Ape1808
All of the following
Siemens Simatic S7-1500 Cpu 1518-4 Pn\/dp Mfp Firmware>=3.1.5
Siemens Simatic S7-1500 Cpu 1518-4 Pn\/dp
All of the following
Siemens Siplus S7-1500 Cpu 1518-4 Pn\/dp Mfp Firmware>=3.1.5
Siemens Siplus S7-1500 Cpu 1518-4 Pn\/dp Mfp
gRPC gRPC<=1.59.2
Nodejs Node.js>=18.0.0<18.18.2
Nodejs Node.js>=20.0.0<20.8.1
Linkerd Linkerd Kubernetes>=2.12.0<=2.12.5
Linkerd Linkerd Kubernetes=2.13.0
Linkerd Linkerd Kubernetes=2.13.1
Linkerd Linkerd Kubernetes=2.14.0
Linkerd Linkerd Kubernetes=2.14.1
All of the following
redhat Service Telemetry Framework=1.5
redhat Enterprise Linux=8.0
Fedoraproject Fedora=37
NetApp OnCommand Insight
Jenkins Jenkins<=2.414.2
Jenkins Jenkins<=2.427
Apache Solr<9.4.0
OpenResty OpenResty<1.21.4.3
Cisco Business Process Automation<3.2.003.009
Cisco Connected Mobile Experiences<11.1
Cisco Crosswork Data Gateway<4.1.3
Cisco Crosswork Data Gateway>=5.0.0<5.0.2
Cisco Crosswork Situation Manager
Cisco Crosswork Zero Touch Provisioning<6.0.0
Cisco Data Center Network Manager
Cisco Enterprise Chat and Email
Cisco Expressway<x14.3.3
Cisco Firepower Threat Defense<7.4.2
Cisco IoT Field Network Director<4.11.0
Cisco Prime Access Registrar<9.3.3
Cisco Prime Cable Provisioning<7.2.1
Cisco Prime Infrastructure<3.10.4
Cisco Prime Network Registrar<11.2
Cisco Secure Dynamic Attributes Connector<2.2.0
Cisco Secure Malware Analytics<2.19.2
Cisco TelePresence Video Communication Server<x14.3.3
Cisco Ultra Cloud Core - Policy Control Function<2024.01.0
Cisco Ultra Cloud Core - Policy Control Function=2024.01.0
Cisco Ultra Cloud Core - Serving Gateway Function<2024.02.0
Cisco Ultra Cloud Core - Session Management Function<2024.02.0
Cisco Unified Attendant Console Advanced
Cisco Unified Contact Center Domain Manager
Cisco Unified Contact Center Enterprise
Cisco Unified Contact Center Enterprise - Live Data Server<12.6.2
Cisco Unified Contact Center Management Portal
Cisco Fog Director<1.22
Cisco IOS XE<17.15.1
Cisco IOS XR<7.11.2
All of the following
Cisco Secure Web Appliance Firmware<15.1.0
Cisco Secure Web Appliance
All of the following
Any of the following
Cisco NX-OS<10.2\(7\)
Cisco NX-OS>=10.3\(1\)<10.3\(5\)
Cisco NX-OS>=10.4\(1\)<10.4\(2\)
Any of the following
Cisco Nexus 3016
Cisco Nexus 3016q
Cisco Nexus 3048
Cisco Nexus 3064
Cisco Nexus 3064-32t
Cisco Nexus 3064-t
Cisco Nexus 3064-x
Cisco Nexus 3064t
Cisco Nexus 3064x
Cisco Nexus 3100
Cisco Nexus 3100-v
Cisco Nexus 3100-z
Cisco Nexus 3100v
Cisco Nexus 31108pc-v
Cisco Nexus 31108pv-v
Cisco Nexus 31108tc-v
Cisco Nexus 31128pq
Cisco Nexus 3132c-z
Cisco Nexus 3132q
Cisco Nexus 3132q-v
Cisco Nexus 3132q-x
Cisco Nexus 3132q-x\/3132q-xl
Cisco Nexus 3132q-xl
Cisco Nexus 3164q
Cisco Nexus 3172
Cisco Nexus 3172pq
Cisco Nexus 3172pq-xl
Cisco Nexus 3172pq\/pq-xl
Cisco Nexus 3172tq
Cisco Nexus 3172tq-32t
Cisco Nexus 3172tq-xl
Cisco Nexus 3200
Cisco Nexus 3232
Cisco Nexus 3232c
Cisco Nexus 3232c
Cisco Nexus 3264c-e
Cisco Nexus 3264q
Cisco Nexus 3400
Cisco Nexus 3408-s
Cisco Nexus 34180yc
Cisco Nexus 34200yc-sm
Cisco Nexus 3432d-s
Cisco Nexus 3464c
Cisco Nexus 3500
Cisco Nexus 3524
Cisco Nexus 3524-x
Cisco Nexus 3524-x\/xl
Cisco Nexus 3524-xl
Cisco Nexus 3548
Cisco Nexus 3548-x
Cisco Nexus 3548-x\/xl
Cisco Nexus 3548-xl
Cisco Nexus 3600
Cisco Nexus 36180yc-r
Cisco Nexus 3636c-r
All of the following
Any of the following
Cisco NX-OS<10.2\(7\)
Cisco NX-OS>=10.3\(1\)<10.3\(5\)
Cisco NX-OS>=10.4\(1\)<10.4\(2\)
Any of the following
Cisco Nexus 9000v
Cisco Nexus 9200
Cisco Nexus 9200yc
Cisco Nexus 92160yc-x
Cisco Nexus 92160yc Switch
Cisco Nexus 9221c
Cisco Nexus 92300yc
Cisco Nexus 92300yc Switch
Cisco Nexus 92304qc
Cisco Nexus 92304qc Switch
Cisco Nexus 9232e
Cisco Nexus 92348gc-x
Cisco Nexus 9236c
Cisco Nexus 9236c Switch
Cisco Nexus 9272q
Cisco Nexus 9272q Switch
Cisco Nexus 9300
Cisco Nexus 93108tc-ex
Cisco Nexus 93108tc-ex-24
Cisco Nexus 93108tc-ex Switch
Cisco Nexus 93108tc-fx
Cisco Nexus 93108tc-fx-24
Cisco Nexus 93108tc-fx3h
Cisco Nexus 93108tc-fx3p
Cisco Nexus 93120tx
Cisco Nexus 93120tx Switch
Cisco Nexus 93128
Cisco Nexus 93128tx
Cisco Nexus 93128tx Switch
Cisco Nexus 9316d-gx
Cisco Nexus 93180lc-ex
Cisco Nexus 93180lc-ex Switch
Cisco Nexus 93180tc-ex
Cisco Nexus 93180yc-ex
Cisco Nexus 93180yc-ex-24
Cisco Nexus 93180yc-ex Switch
Cisco Nexus 93180yc-fx
Cisco Nexus 93180yc-fx-24
Cisco Nexus 93180yc-fx3
Cisco Nexus 93180yc-fx3h
Cisco Nexus 93180yc-fx3s
Cisco Nexus 93216tc-fx2
Cisco Nexus 93240tc-fx2
Cisco Nexus 93240yc-fx2
Cisco Nexus 9332c
Cisco Nexus 9332d-gx2b
Cisco Nexus 9332d-h2r
Cisco Nexus 9332pq
Cisco Nexus 9332pq Switch
Cisco Nexus 93360yc-fx2
Cisco Nexus 9336c-fx2
Cisco Nexus 9336c-fx2-e
Cisco Nexus 9336pq
Cisco Nexus 9336pq Aci
Cisco Nexus 9336pq Aci Spine
Cisco Nexus 9336pq Aci Spine Switch
Cisco Nexus 9348d-gx2a
Cisco Nexus 9348gc-fx3
Cisco Nexus 9348gc-fxp
Cisco Nexus 93600cd-gx
Cisco Nexus 9364c
Cisco Nexus 9364c-gx
Cisco Nexus 9364d-gx2a
Cisco Nexus 9372px
Cisco Nexus 9372px-e
Cisco Nexus 9372px-e Switch
Cisco Nexus 9372px Switch
Cisco Nexus 9372tx
Cisco Nexus 9372tx-e
Cisco Nexus 9372tx-e Switch
Cisco Nexus 9372tx Switch
Cisco Nexus 9396px
Cisco Nexus 9396px Switch
Cisco Nexus 9396tx
Cisco Nexus 9396tx Switch
Cisco Nexus 9408
Cisco Nexus 9432pq
Cisco Nexus 9500
Cisco Nexus 9500 16-slot
Cisco Nexus 9500 4-slot
Cisco Nexus 9500 8-slot
Cisco Nexus 9500 Supervisor A
Cisco Nexus 9500 Supervisor A\+
Cisco Nexus 9500 Supervisor B
Cisco Nexus 9500 Supervisor B\+
Cisco Nexus 9500r
Cisco Nexus 9504
Cisco Nexus 9504 Switch
Cisco Nexus 9508
Cisco Nexus 9508 Switch
Cisco Nexus 9516
Cisco Nexus 9516 Switch
Cisco Nexus 9536pq
Cisco Nexus 9636pq
Cisco Nexus 9716d-gx
Cisco Nexus 9736pq
Cisco Nexus 9800
Cisco Nexus 9804
Cisco Nexus 9808
Microsoft Windows 10=22H2
10.0.19045.3570
Microsoft Windows Server 2016<10.0.14393.6351
10.0.14393.6351
Microsoft Windows 11=21H2
10.0.22000.2538
Microsoft Windows 10=1607
10.0.14393.6351
Microsoft Windows 11=22H2
10.0.22621.2428
Microsoft Windows 10=1607
10.0.14393.6351
Microsoft Windows 10=21H2
10.0.19044.3570
Microsoft Windows 10=22H2
10.0.19045.3570
Microsoft Windows Server 2016<10.0.14393.6351
10.0.14393.6351
Microsoft Windows Server 2022<10.0.20348.2031
10.0.20348.2031
Microsoft Windows 10=22H2
10.0.19045.3570
Microsoft Windows Server 2019<10.0.17763.4974
10.0.17763.4974
Microsoft Windows 11=22H2
10.0.22621.2428
Microsoft Windows Server 2019<10.0.17763.4974
10.0.17763.4974
Microsoft Windows Server 2022<10.0.20348.2031
10.0.20348.2031
Microsoft Windows 11=21H2
10.0.22000.2538
Microsoft Windows 10=21H2
10.0.19044.3570
Microsoft Windows 10=21H2
10.0.19044.3570
Microsoft Windows 10=1809
10.0.17763.4974
Microsoft Windows 10=1809
10.0.17763.4974
Microsoft Visual Studio 2022=17.4
17.4.13
Microsoft ASP.NET Core=7.0
7.0.13
Microsoft Windows 10=1809
10.0.17763.4974
Microsoft Visual Studio 2022=17.6
17.6.9
Microsoft ASP.NET Core=6.0
6.0.24
Microsoft Visual Studio 2022=17.7
17.7.6
Microsoft Visual Studio 2022=17.2
17.2.21
Microsoft .NET 6.0<6.0.24
6.0.24
Microsoft .NET 7.0<7.0.13
7.0.13
redhat/golang<1.21.3
1.21.3
redhat/golang<1.20.10
1.20.10
redhat/tomcat<11.0.0
11.0.0
redhat/tomcat<10.1.14
10.1.14
redhat/tomcat<9.0.81
9.0.81
redhat/tomcat<8.5.94
8.5.94
redhat/nghttp2<1.57.0
1.57.0
redhat/netty<4.1.100.
4.1.100.
debian/dnsdist<=1.5.1-3, <=1.7.3-2
1.9.15-0+deb13u12.1.0-2
debian/grpc<=1.30.2-3, <=1.51.1-3, <=1.51.1-6, <=1.51.1-9
debian/h2o<=2.2.5+dfsg2-6, <=2.2.5+dfsg2-7
debian/haproxy
2.2.9-2+deb11u62.2.9-2+deb11u72.6.12-1+deb12u33.0.11-1+deb13u33.2.21-1
debian/jetty9
9.4.50-4+deb11u29.4.57-0+deb11u39.4.57-1.1~deb12u19.4.57-1.1~deb13u19.4.58-2
debian/netty
1:4.1.48-4+deb11u21:4.1.48-4+deb11u31:4.1.48-7+deb12u21:4.1.48-10+deb13u11:4.1.48-16
debian/nghttp2
1.43.0-1+deb11u11.43.0-1+deb11u31.52.0-1+deb12u31.64.0-1.1+deb13u11.69.0-1
debian/nginx<=1.18.0-6.1+deb11u3, <=1.18.0-6.1+deb11u8, <=1.22.1-9+deb12u9
1.26.3-3+deb13u71.30.1-7
debian/tomcat10
10.1.55-1~deb12u110.1.55-1~deb13u110.1.55-1
debian/tomcat9
9.0.43-2~deb11u109.0.118-0+deb11u19.0.70-29.0.95-19.0.118-1
debian/trafficserver
8.1.10+ds-1~deb11u18.1.11+ds-0+deb11u29.2.5+ds-0+deb12u49.2.5+ds-1
debian/varnish<=6.5.1-1+deb11u3, <=6.5.1-1+deb11u5, <=7.1.1-2+deb12u1
7.7.0-3+deb13u1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/netty to a version that resolves this vulnerability.

    Fixed in 1:4.1.48-8Fixed in 1:4.1.48-4+deb11u2Fixed in 1:4.1.48-7+deb12u1
  2. Upgrade

    Upgrade maven/org.apache.tomcat:tomcat-coyote to a version that resolves this vulnerability.

    Fixed in 8.5.94
  3. Upgrade

    Upgrade maven/org.apache.tomcat:tomcat-coyote to a version that resolves this vulnerability.

    Fixed in 9.0.81
  4. Upgrade

    Upgrade maven/org.apache.tomcat:tomcat-coyote to a version that resolves this vulnerability.

    Fixed in 10.1.14
  5. Upgrade

    Upgrade maven/org.apache.tomcat:tomcat-coyote to a version that resolves this vulnerability.

    Fixed in 11.0.0-M12
  6. Upgrade

    Upgrade maven/com.typesafe.akka:akka-http-core_2.12 to a version that resolves this vulnerability.

    Fixed in 10.5.3
  7. Upgrade

    Upgrade maven/com.typesafe.akka:akka-http-core_2.13 to a version that resolves this vulnerability.

    Fixed in 10.5.3
  8. Upgrade

    Upgrade maven/com.typesafe.akka:akka-http-core to a version that resolves this vulnerability.

    Fixed in 10.5.3
  9. Upgrade

    Upgrade maven/org.eclipse.jetty.http2:jetty-http2-server to a version that resolves this vulnerability.

    Fixed in 12.0.2
  10. Upgrade

    Upgrade maven/org.eclipse.jetty.http2:jetty-http2-common to a version that resolves this vulnerability.

    Fixed in 12.0.2
  11. Upgrade

    Upgrade maven/org.eclipse.jetty.http2:http2-server to a version that resolves this vulnerability.

    Fixed in 11.0.17
  12. Upgrade

    Upgrade maven/org.eclipse.jetty.http2:http2-server to a version that resolves this vulnerability.

    Fixed in 10.0.17
  13. Upgrade

    Upgrade maven/org.eclipse.jetty.http2:http2-server to a version that resolves this vulnerability.

    Fixed in 9.4.53
  14. Upgrade

    Upgrade maven/org.eclipse.jetty.http2:http2-common to a version that resolves this vulnerability.

    Fixed in 11.0.17
  15. Upgrade

    Upgrade maven/org.eclipse.jetty.http2:http2-common to a version that resolves this vulnerability.

    Fixed in 10.0.17
  16. Upgrade

    Upgrade maven/org.eclipse.jetty.http2:http2-common to a version that resolves this vulnerability.

    Fixed in 9.4.53
  17. Upgrade

    Upgrade swift/github.com/apple/swift-nio-http2 to a version that resolves this vulnerability.

    Fixed in 1.28.0
  18. Upgrade

    Upgrade maven/org.apache.tomcat.embed:tomcat-embed-core to a version that resolves this vulnerability.

    Fixed in 8.5.94
  19. Upgrade

    Upgrade maven/org.apache.tomcat.embed:tomcat-embed-core to a version that resolves this vulnerability.

    Fixed in 9.0.81
  20. Upgrade

    Upgrade maven/org.apache.tomcat.embed:tomcat-embed-core to a version that resolves this vulnerability.

    Fixed in 10.1.14
  21. Upgrade

    Upgrade maven/org.apache.tomcat.embed:tomcat-embed-core to a version that resolves this vulnerability.

    Fixed in 11.0.0-M12
  22. Upgrade

    Upgrade go/google.golang.org/grpc to a version that resolves this vulnerability.

    Fixed in 1.56.3
  23. Upgrade

    Upgrade go/google.golang.org/grpc to a version that resolves this vulnerability.

    Fixed in 1.57.1
  24. Upgrade

    Upgrade go/google.golang.org/grpc to a version that resolves this vulnerability.

    Fixed in 1.58.3
  25. Upgrade

    Upgrade go/golang.org/x/net to a version that resolves this vulnerability.

    Fixed in 0.17.0
  26. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 20.1.0
  27. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.0.0
  28. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 17.1.1.3
  29. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 16.1.4.3
  30. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 15.1.10.4
  31. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 30
  32. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 3.3.1
  33. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.19045.3570Patch KB5031356
  34. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.14393.6351Patch KB5031362
  35. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.22000.2538Patch KB5031358
  36. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.22621.2428Patch KB5031354
  37. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.19044.3570Patch KB5031356
  38. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.20348.2031Patch KB5031364
  39. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.17763.4974Patch KB5031361
  40. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 17.4.13
  41. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 7.0.13
  42. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 17.6.9
  43. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 6.0.24
  44. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 17.7.6
  45. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 17.2.21
  46. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 6.0.24Patch KB5032874
  47. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 7.0.13Patch KB5032875
  48. Upgrade

    Upgrade redhat/golang to a version that resolves this vulnerability.

    Fixed in 1.21.3
  49. Upgrade

    Upgrade redhat/golang to a version that resolves this vulnerability.

    Fixed in 1.20.10
  50. Upgrade

    Upgrade redhat/tomcat to a version that resolves this vulnerability.

    Fixed in 11.0.0
  51. Upgrade

    Upgrade redhat/tomcat to a version that resolves this vulnerability.

    Fixed in 10.1.14
  52. Upgrade

    Upgrade redhat/tomcat to a version that resolves this vulnerability.

    Fixed in 9.0.81
  53. Upgrade

    Upgrade redhat/tomcat to a version that resolves this vulnerability.

    Fixed in 8.5.94
  54. Upgrade

    Upgrade redhat/nghttp2 to a version that resolves this vulnerability.

    Fixed in 1.57.0
  55. Upgrade

    Upgrade redhat/netty to a version that resolves this vulnerability.

    Fixed in 4.1.100.
  56. Upgrade

    Upgrade debian/dnsdist to a version that resolves this vulnerability.

    Fixed in 1.9.15-0+deb13u1Fixed in 2.1.0-2
  57. Upgrade

    Upgrade debian/haproxy to a version that resolves this vulnerability.

    Fixed in 2.2.9-2+deb11u6Fixed in 2.2.9-2+deb11u7Fixed in 2.6.12-1+deb12u3Fixed in 3.0.11-1+deb13u3Fixed in 3.2.21-1
  58. Upgrade

    Upgrade debian/jetty9 to a version that resolves this vulnerability.

    Fixed in 9.4.50-4+deb11u2Fixed in 9.4.57-0+deb11u3Fixed in 9.4.57-1.1~deb12u1Fixed in 9.4.57-1.1~deb13u1Fixed in 9.4.58-2
  59. Upgrade

    Upgrade debian/netty to a version that resolves this vulnerability.

    Fixed in 1:4.1.48-4+deb11u2Fixed in 1:4.1.48-4+deb11u3Fixed in 1:4.1.48-7+deb12u2Fixed in 1:4.1.48-10+deb13u1Fixed in 1:4.1.48-16
  60. Upgrade

    Upgrade debian/nghttp2 to a version that resolves this vulnerability.

    Fixed in 1.43.0-1+deb11u1Fixed in 1.43.0-1+deb11u3Fixed in 1.52.0-1+deb12u3Fixed in 1.64.0-1.1+deb13u1Fixed in 1.69.0-1
  61. Upgrade

    Upgrade debian/nginx to a version that resolves this vulnerability.

    Fixed in 1.26.3-3+deb13u7Fixed in 1.30.1-7
  62. Upgrade

    Upgrade debian/tomcat10 to a version that resolves this vulnerability.

    Fixed in 10.1.55-1~deb12u1Fixed in 10.1.55-1~deb13u1Fixed in 10.1.55-1
  63. Upgrade

    Upgrade debian/tomcat9 to a version that resolves this vulnerability.

    Fixed in 9.0.43-2~deb11u10Fixed in 9.0.118-0+deb11u1Fixed in 9.0.70-2Fixed in 9.0.95-1Fixed in 9.0.118-1
  64. Upgrade

    Upgrade debian/trafficserver to a version that resolves this vulnerability.

    Fixed in 8.1.10+ds-1~deb11u1Fixed in 8.1.11+ds-0+deb11u2Fixed in 9.2.5+ds-0+deb12u4Fixed in 9.2.5+ds-1
  65. Upgrade

    Upgrade debian/varnish to a version that resolves this vulnerability.

    Fixed in 7.7.0-3+deb13u1
  66. Upgrade

    Upgrade swift-nio-http2 to a version that resolves this vulnerability.

    Fixed in 1.28
  67. Compensating control

    If mitigations are unavailable for the affected product, discontinue use of the product (per advisory text: discontinue use if mitigations are unavailable).

Event History

Oct 9, 2023
Data Sourced
via Red Hat·04:47 AM
DescriptionSeverityAffected Software
Oct 10, 2023
CVE Published
via MITRE·12:00 AM
Known Exploited
via CISA·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·07:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
Description
Advisory Published
via F5·12:00 PM
Data Sourced
via F5·12:00 PM
DescriptionSeverityWeaknessAffected Software
News Published
via BleepingComputer·02:12 PM
Data Sourced
via NVD·02:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
News Published
via Dark Reading·06:37 PM
News Published
via The Register·08:37 PM
Advisory Published
via GitHub·09:28 PM
Data Sourced
via GitHub·09:28 PM
DescriptionSeverityWeaknessAffected Software
News Published
11:46 PM
Jan 19, 2024
News Published
via BleepingComputer·09:51 PM
News Published
via The Register·09:51 PM
Feb 8, 2024
Advisory Published
via FortiGuard·12:00 AM
News Published
via BleepingComputer·11:11 PM
Dec 18, 2024
Advisory Published
via FortiGuard·06:19 PM
Dec 20, 2024
News Published
via Dark Reading·12:00 AM
Aug 14, 2025
News Published
via The Register·05:39 PM
Sep 11, 2025
Data Sourced
via Launchpad·02:39 PM
Description
Sep 16, 2025
Exploit Published
12:00 AM
Nov 28, 2025
Data Sourced
via Ubuntu·07:23 AM
RemedyDescriptionSeverityAffected Software
Mar 4, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Apr 22, 2026
Data Sourced
via GitLab·08:52 AM
Description
Jul 24, 2026
Data Sourced
via Debian·12:21 PM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2023-44487?

CVE-2023-44487 has been classified with a critical severity rating due to its potential for exploitation through rapid reset attacks in the HTTP/2 protocol.

2

How do I fix CVE-2023-44487?

To remediate CVE-2023-44487, users should apply the security patches and updates provided by their software vendors for affected products or libraries.

3

What products are affected by CVE-2023-44487?

CVE-2023-44487 affects multiple Microsoft Windows versions, .NET, various Debian packages, and notable server and application software relying on HTTP/2.

4

Can CVE-2023-44487 be exploited remotely?

Yes, attackers can exploit CVE-2023-44487 remotely to disrupt services by sending malicious HTTP/2 requests that trigger rapid stream resets.

5

What is the recommended action for administrators regarding CVE-2023-44487?

Administrators should prioritize assessing their environments for affected software, applying available updates immediately, and monitoring for suspicious activity.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203