PT-2026-29959 · Julia · Openresty Jll+1

Published 2026-03-23 · Updated 2026-03-23

OSV

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Exploit

Related Identifiers

JLSEC-2026-3

Affected Products

Openresty Jll

Nghttp2 Jll

References · 169

• 🔥 https://github.com/bcdannyboy/CVE-2023-44487 · Exploit
• 🔥 https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487 · Exploit
• https://debian.org/security/2023/dsa-5522 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ · Vendor Advisory
• https://debian.org/security/2023/dsa-5540 · Vendor Advisory
• https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-44487 · Vendor Advisory