Patchfirst
Patchfirst
ChainIETF · HTTP/2SwiftURL:github.com/apple/swift-nio-http2

IETF HTTP/2: incomplete fixes (2023–2024)

5 CVEs over 3 generations, 10 Oct 2023 to 18 Dec 2024. 1 is in .

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2023-4448710 Oct 2023KEV First in the chain
  2. CVE-2023-3932511 Oct 2023 related to CVE-2023-44487
  3. CVE-2023-659625 Apr 2024 incomplete fix for CVE-2023-44487incomplete fix for CVE-2023-39325
  4. CVE-2024-44388 May 2024 incomplete fix for CVE-2023-44487incomplete fix for CVE-2023-39325
  5. CVE-2024-1269818 Dec 2024 incomplete fix for CVE-2023-44487incomplete fix for CVE-2023-39325
Oct 2023NovApr 2024MayJunSepDec CVE-2023-44487 → CVE-2023-39325: related (high confidence)CVE-2023-44487 → CVE-2023-6596: incomplete fix (high confidence)CVE-2023-44487 → CVE-2024-12698: incomplete fix (high confidence)CVE-2023-44487 → CVE-2024-4438: incomplete fix (high confidence)CVE-2023-39325 → CVE-2023-6596: incomplete fix (high confidence)CVE-2023-39325 → CVE-2024-12698: incomplete fix (high confidence)CVE-2023-39325 → CVE-2024-4438: incomplete fix (high confidence) CVE-2023-44487 10 Oct 2023 CVE-2023-39325 11 Oct 2023 CVE-2023-6596 25 Apr 2024 CVE-2024-4438 8 May 2024 CVE-2024-12698 18 Dec 2024 Oct 2023NovJan 2024AprMayJunAugOctDec CVE-2023-44487 → CVE-2023-39325: related (high confidence)CVE-2023-44487 → CVE-2023-6596: incomplete fix (high confidence)CVE-2023-44487 → CVE-2024-12698: incomplete fix (high confidence)CVE-2023-44487 → CVE-2024-4438: incomplete fix (high confidence)CVE-2023-39325 → CVE-2023-6596: incomplete fix (high confidence)CVE-2023-39325 → CVE-2024-12698: incomplete fix (high confidence)CVE-2023-39325 → CVE-2024-4438: incomplete fix (high confidence) CVE-2023-44487 10 Oct 2023 CVE-2023-39325 11 Oct 2023 CVE-2023-6596 25 Apr 2024 CVE-2024-4438 8 May 2024 CVE-2024-12698 18 Dec 2024
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2023-44487KEV 10 Oct 2023 HTTP/2 Rapid Reset Attack Vulnerability · fixed in 10.5.3 First in chain 68.2
CVE-2023-39325 11 Oct 2023 HTTP/2 rapid reset can cause excessive work in net/http · fixed in 1.21.3 CVE-2023-44487 · related · High 23.0
CVE-2023-6596 25 Apr 2024 Openshift: incomplete fix for rapid reset (cve-2023-44487/cve-2023-39325) CVE-2023-44487 · incomplete fix · High 16.5
CVE-2024-4438 8 May 2024 Etcd: incomplete fix for cve-2023-39325/cve-2023-44487 in openstack platform CVE-2023-44487 · incomplete fix · High 16.5
CVE-2024-12698 18 Dec 2024 Ose-olm-catalogd-container: incomplete fix for rapid reset (cve-2023-39325/cve-2023-44487) CVE-2023-44487 · incomplete fix · High 13.1
↑ ↓ chooseEnter openEsc close