CVE: 2023-44487 found in tomcat-embed-core - Version: 9.0.36 [GO]

[Rajkumarr77]

Veracode Software Composition Analysis

Attribute	Details
Library	tomcat-embed-core
Description	Core Tomcat implementation
Language	GO
Vulnerability	Denial Of Service (DoS)
Vulnerability description	Libraries that implement HTTP/2 are vulnerable to Denial Of Service (DoS). The vulnerability could be exploited by attackers via sending a large number of HTTP/2 requests to a vulnerable server, then canceling them, causing the server to consume excessive resources and become unavailable to legitimate users. This vulnerability is known as "Rapid Reset".
CVE	2023-44487
CVSS score	7.8
Vulnerability present in version/s	9.0.0.M1-9.0.80
Found library version/s	9.0.36
Vulnerability fixed in version	9.0.81
Library latest version	11.0.9
Fix

Links:

• https://sca.analysiscenter.veracode.com/vulnerability-database/libraries/1334?version=9.0.36
• https://sca.analysiscenter.veracode.com/vulnerability-database/vulnerabilities/43799
• Patch: apache/tomcat@6d1a9fd