CVE-2023-44487 - Denial of Service (DoS)
Severity: High2024-01-30
Abstract
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
The Oxygen products incorporate Netty as a third-party libraries. This advisory was opened to address the potential impact of this third-party libraries vulnerability.
Affected Products/Versions
| Product | Severity | Fixed Release Availability |
| Oxygen Content Fusion v5.1.2 and older | Low | Oxygen Content Fusion 6.0 build 2023110109 |
| Oxygen Publishing Engine v26.0 and older | None | N/A |
| Oxygen XML Web Author v26.0.0 and older | High | Oxygen Web Author 26.0.0.1 build 2024022608 |
Detail
CVE-2023-44487
Severity: Critical
CVSS Score: 7.5
The netty third-party libraries used by Oxygen XML products are an affected version mentioned in CVE-2023-44487 vulnerability description. However, Oxygen Content Fusion uses the Netty library only for internal network. For that reason we rated this vulnerability as low.
