Bug 918416

Summary:	www-servers/varnish: http/2 rapid reset vulnerability
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	minor	CC:	maintainer-needed
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/varnishcache/varnish-cache/issues/3996
Whiteboard:	B3 [ebuild]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2023-11-24 18:52:14 UTC

Alias:
CVE-2023-44487:

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

According to https://varnish-cache.org/security/VSV00013.html#vsv00013,
fixed in 6.0.12, 7.3.1, and 7.4.2.