CASCACascade Atlas

Evidence dossier

CVE-2023-44487

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August…

Exploited in the wild (CISA KEV since Oct 10, 2023). NVD reports CVSS 3.1 7.5. EPSS estimates 100.0% exploit likelihood as of Oct 20, 2026.

78.7–93.7Priority evidence range
Evidence through Oct 22, 2026, 6:07 PM UTC

As of Oct 22, 2026

Normalized restatement

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

State
PUBLISHED
Published
Oct 10, 2023
Updated
Oct 14, 2026
Evidence coverage
85%

Evidence chronology

What was known when

Download this view's receipt →
  1. Source dateFirst observed by CASCA
    CISA KEV

    Exploitation cataloged: HTTP/2 Rapid Reset Attack Vulnerability

    Inspect raw assertion
    Field
    observed_exploitation
    Value
    HTTP/2 Rapid Reset Attack Vulnerability
    Original evidence ↗
  2. Source dateSource date omittedFirst observed by CASCA
    CISA-ADP

    Record text: CISA ADP Vulnrichment

    Inspect raw assertion
    Field
    container
    Value
    CISA ADP Vulnrichment
    Original evidence ↗
  3. Source dateSource date omittedFirst observed by CASCA
    CVE Program

    Record text: CVE Program Container

    Inspect raw assertion
    Field
    container
    Value
    CVE Program Container
    Original evidence ↗
  4. Source dateSource date omittedFirst observed by CASCA
    mitre

    Record text: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

    Inspect raw assertion
    Field
    container
    Value
    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
    Original evidence ↗
  5. Source dateSource date omittedFirst observed by CASCA
    siemens-SADP

    Record text: Container present

    Inspect raw assertion
    Field
    container
    Value
    Container present
    Original evidence ↗
  6. Source dateFirst observed by CASCA
    FIRST EPSS

    EPSS score: 100% probability · 100th percentile

    Inspect raw assertion
    Field
    model_probability
    Value
    Probability 0.999990000000; percentile 0.999990000000
    Original evidence ↗
ExploitationCatalog member

CISA KEV · catalog date Oct 10, 2023 · first observed Sep 1, 2026

Exploit likelihood100.00%

FIRST EPSS · score date Oct 20, 2026 · 100th percentile · first observed Oct 20, 2026

SeverityCVSS 7.5

NVD · CVSS 3.1 · first observed Aug 11, 2026 · same-version scores align in this snapshot

Evidence detail

Source limits and decisions

Why each evidence state has this value

Outside this view’s verified evidence

Reason detail begins outside this selected snapshot; the state remains source-bound.

Source comparison

Who said what

CISA KEVOriginal assertion
Exploitation cataloged

HTTP/2 Rapid Reset Attack Vulnerability

Inspect raw assertion
Field
observed_exploitation
Value
HTTP/2 Rapid Reset Attack Vulnerability
Source dateFirst observed by CASCAOriginal evidence ↗
CISA-ADPIndependent enrichment
Record text

CISA ADP Vulnrichment

Inspect raw assertion
Field
container
Value
CISA ADP Vulnrichment
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CVE ProgramDerivative copy
Record text

CVE Program Container

Inspect raw assertion
Field
container
Value
CVE Program Container
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
mitreOriginal assertion
Record text

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Inspect raw assertion
Field
container
Value
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
siemens-SADPSource-declared origin
Record text

Container present

Inspect raw assertion
Field
container
Value
Container present
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
FIRST EPSSOriginal assertion
EPSS score

100% probability · 100th percentile

Inspect raw assertion
Field
model_probability
Value
Probability 0.999990000000; percentile 0.999990000000
Source dateFirst observed by CASCAOriginal evidence ↗

Applicability

Cited product scope

Trace impact →
464Underlying assertions
324Canonical products
304Target assertions
160Constraint assertions

Grouped from 52 configuration nodes in this exact snapshot. Visual grouping is navigational; asset exposure and root cause require cited evidence.

Identity source boundaries
  • Cpe dictionary1,775,266 records · observed through 2026-07-21T06:45:29.809Z27d65b0f-b718-4b4f-bb79-c47c68d09dfa
  • Cpe match643,502 records · observed through 2026-07-21T08:13:17.697Z955dae73-7302-438b-aee1-058d7cc5d48e

334 scope groups

CISA-ADP · source assertedietfhttpDirect source scope
Affected: 2.0
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "2.0"}]
mitre · source assertedn/an/aDirect source scope
Affected: n/a
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "n/a"}]
siemens-SADP · source assertedSiemensRUGGEDCOM APE1808Direct source scope
Affected: 0 to before * (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}]
siemens-SADP · source assertedSiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFPDirect source scope
Affected: V3.1.5 to before * (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}]
siemens-SADP · source assertedSiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFPDirect source scope
Affected: V3.1.5 to before * (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}]
siemens-SADP · source assertedSiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFPDirect source scope
Affected: V3.1.5 to before * (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}]
siemens-SADP · source assertedSiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFPDirect source scope
Affected: V3.1.5 to before * (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}]
siemens-SADP · source assertedSiemensSINEC NMSDirect source scope
Affected: 0 to before V3.0 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "0", "lessThan": "V3.0", "versionType": "custom"}]
siemens-SADP · source assertedSiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFPDirect source scope
Affected: V3.1.5 to before * (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}]
NVD CPE · APPLICATIONakkahttp_serverVulnerable target · 1 assertions
Any version (unconstrained) (< 10.5.3)Canonical identity product-9776d53f82f44173c196d4c32d62e08ba7e5a2d28c4571d3d9541f066a369672Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:a:akka:http_server:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    35 · node/0 · match 0
    Logic
    OR
    Version bounds
    through excluding 10.5.3
    Match ID
    c2792650-851f-4820-b003-06a4bea092d7
NVD CPE · APPLICATIONamazonopensearch_data_prepperVulnerable target · 1 assertions
Any version (unconstrained) (< 2.5.0)Canonical identity product-b830e5a86146ab82d53e34102b7e2666aa59c2c48a3b942ca0f2bce8c40be868Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:a:amazon:opensearch_data_prepper:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    22 · node/0 · match 0
    Logic
    OR
    Version bounds
    through excluding 2.5.0
    Match ID
    6f70360d-6214-46ba-af82-6ab01e13e4e9
NVD CPE · APPLICATIONapacheapisixVulnerable target · 1 assertions
Any version (unconstrained) (< 3.6.1)Canonical identity product-caed4e90c360cff225b5314e1a6a2793deed8338c5c3912d0a901cd560df6f42Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    21 · node/0 · match 0
    Logic
    OR
    Version bounds
    through excluding 3.6.1
    Match ID
    edeb508e-0ebd-4450-9074-983ddf568ab4
NVD CPE · APPLICATIONapachesolrVulnerable target · 1 assertions
Any version (unconstrained) (< 9.4.0)Canonical identity product-b2893c436d20eeea3899b65735644a7c662137429e9b2fba8a3cdbf6d307d1afLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    38 · node/0 · match 0
    Logic
    OR
    Version bounds
    through excluding 9.4.0
    Match ID
    8e1affb9-c717-4727-b0c9-5a0c281710e2
NVD CPE · APPLICATIONapachetomcatVulnerable target · 14 assertions
Any version (unconstrained) (>= 10.1.0, <= 10.1.13); Any version (unconstrained) (>= 8.5.0, <= 8.5.93); Any version (unconstrained) (>= 9.0.0, <= 9.0.80); Version 11.0.0Canonical identity product-b4642eb973ddbe1a3e24c089bf036c528ab40d12c3eab0fae6fd551615375441Linked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    13 · node/0 · match 3
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d1aa7ff6-e8e7-4bf6-983e-0a99b0183008
  2. cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    13 · node/0 · match 10
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    49350a6e-5e1d-45b2-a874-3b8601b3adcc
  3. cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    13 · node/0 · match 6
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    2aad52ce-94f5-4f98-a027-9a7e68818cb6
  4. cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    13 · node/0 · match 11
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    5f50942f-df54-46c0-8371-9a476dd3eea3
  5. cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    13 · node/0 · match 1
    Logic
    OR
    Version bounds
    from including 9.0.0; through including 9.0.80
    Match ID
    f3ec20b6-b2ab-41f5-9bf9-d16c1fe67c34
  6. cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    13 · node/0 · match 4
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    57088bdd-a136-45ef-a8a1-2ebf79cec2ce
  7. cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    13 · node/0 · match 8
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    03a171af-2ec8-4422-912c-547cdb58caaa
  8. cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    13 · node/0 · match 12
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d12c2c95-b79f-4aa4-8ce3-99a3ee7991ab
  9. cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    13 · node/0 · match 7
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    f1f981f5-035a-4edd-8a9f-481ee8bc7ff7
  10. cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    13 · node/0 · match 5
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b32d1d7a-a04f-444e-8f45-bb9a9e4b0199
  11. cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    13 · node/0 · match 9
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    538e68c4-0ba4-495f-aef8-4ef6ee7963cf
  12. cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    13 · node/0 · match 2
    Logic
    OR
    Version bounds
    from including 10.1.0; through including 10.1.13
    Match ID
    0765cc3d-ab1a-4147-8900-ef4c105321f2
  13. cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    13 · node/0 · match 0
    Logic
    OR
    Version bounds
    from including 8.5.0; through including 8.5.93
    Match ID
    abd26b48-cc80-4fae-bd3d-78de4c80c92b
  14. cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    13 · node/0 · match 13
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    98792138-dd56-42df-9612-3bdc65eec117
NVD CPE · APPLICATIONapachetraffic_serverVulnerable target · 2 assertions
Any version (unconstrained) (>= 8.0.0, < 8.1.9); Any version (unconstrained) (>= 9.0.0, < 9.2.3)Canonical identity product-c42bc7eba6af637a13fb54eab5f94bd3e9e3419eb58b3129923d3cdd9a5c0ef6Linked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    21 · node/0 · match 1
    Logic
    OR
    Version bounds
    from including 8.0.0; through excluding 8.1.9
    Match ID
    93a1a748-6c71-4191-8a16-a93e94e2cde4
  2. cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    21 · node/0 · match 2
    Logic
    OR
    Version bounds
    from including 9.0.0; through excluding 9.2.3
    Match ID
    4e4bcaf6-b246-41ec-9ee1-24296bfc4f5a
NVD CPE · APPLICATIONappleswiftnio_http/2Vulnerable target · 1 assertions
Any version (unconstrained) (< 1.28.0)Canonical identity product-0ca8c293371722f491e234d0bb6b9c183287ad109f0ea981c8a026055c733a11Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:a:apple:swiftnio_http\/2:*:*:*:*:*:swift:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    14 · node/0 · match 0
    Logic
    OR
    Version bounds
    through excluding 1.28.0
    Match ID
    08190072-3880-4ef5-b642-ba053090d95b
NVD CPE · APPLICATIONcaddyservercaddyVulnerable target · 1 assertions
Any version (unconstrained) (< 2.7.5)Canonical identity product-a3ce70be7384b3b896eed19051027b0619c4836b397ccb0e3ed214b628c3207aLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    10 · node/0 · match 0
    Logic
    OR
    Version bounds
    through excluding 2.7.5
    Match ID
    6341ddda-ad27-4087-9d59-0a212f0037b4
NVD CPE · APPLICATIONciscobusiness_process_automationVulnerable target · 1 assertions
Any version (unconstrained) (< 3.2.003.009)Canonical identity product-364e1e4d7e29948d0c858987580f80a37236abf4b7817e9e28346fe5956cc208Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:a:cisco:business_process_automation:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    40 · node/0 · match 0
    Logic
    OR
    Version bounds
    through excluding 3.2.003.009
    Match ID
    fb2bdbac-8d19-4f81-8d31-6d0955a53d82
NVD CPE · APPLICATIONciscoconnected_mobile_experiencesVulnerable target · 1 assertions
Any version (unconstrained) (< 11.1)Canonical identity product-dc7d7adfe50f1fd081ca3b9776e4791a048f385df865e8fbca88705b5cf42e33Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:a:cisco:connected_mobile_experiences:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    40 · node/0 · match 1
    Logic
    OR
    Version bounds
    through excluding 11.1
    Match ID
    f98f9d27-6659-413f-8f29-4fdb0882aac5
NVD CPE · APPLICATIONciscocrosswork_data_gatewayVulnerable target · 2 assertions
Any version (unconstrained) (< 4.1.3); Any version (unconstrained) (>= 5.0.0, < 5.0.2)Canonical identity product-92616884c37306fc8794ae010618f83d6050f2570e1ee05f20d936b5324614d1Linked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:a:cisco:crosswork_data_gateway:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    40 · node/0 · match 3
    Logic
    OR
    Version bounds
    from including 5.0.0; through excluding 5.0.2
    Match ID
    3f30e209-fa52-4d3b-9b88-4193ea388554
  2. cpe:2.3:a:cisco:crosswork_data_gateway:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    40 · node/0 · match 2
    Logic
    OR
    Version bounds
    through excluding 4.1.3
    Match ID
    c98bf315-c563-47c2-bad1-63347a3d1008
NVD CPE · APPLICATIONciscocrosswork_situation_managerVulnerable target · 1 assertions
Version not applicableCanonical identity product-463dd0156b0589555287f4e1c346f3190b2d3333b1111f1782019d2ff9dd577fLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:a:cisco:crosswork_situation_manager:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    40 · node/0 · match 4
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    3178f3a5-a072-44e1-a225-b04bc536f4fb
NVD CPE · APPLICATIONciscocrosswork_zero_touch_provisioningVulnerable target · 1 assertions
Any version (unconstrained) (< 6.0.0)Canonical identity product-07d1911e5dfe73ef44ee2ed85187496b5a431e58793cac536dfcd97a4587f973Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:a:cisco:crosswork_zero_touch_provisioning:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    40 · node/0 · match 5
    Logic
    OR
    Version bounds
    through excluding 6.0.0
    Match ID
    aa2be0f1-dd16-4876-8eba-f187bd38b159
NVD CPE · APPLICATIONciscodata_center_network_managerVulnerable target · 1 assertions
Version not applicableCanonical identity product-820da73e8b1ce20a148c02808326fc3d77735d2e6ad9ea94c13e16c5de944840Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:a:cisco:data_center_network_manager:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    40 · node/0 · match 6
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    796b6c58-2140-4105-a2a1-69865a194a75
NVD CPE · APPLICATIONciscoenterprise_chat_and_emailVulnerable target · 1 assertions
Version not applicableCanonical identity product-129eab901ba327e52cee2d1cc1cae44edf100fdb576a36c4d01455a2bb1517afLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:a:cisco:enterprise_chat_and_email:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    40 · node/0 · match 7
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    dea99dc6-ea03-469f-a8be-7f96fdf0b333
NVD CPE · APPLICATIONciscoexpresswayVulnerable target · 1 assertions
Any version (unconstrained) (< x14.3.3)Canonical identity product-042d135e36637e89339aad298e5307d2741962385320af758c1b2746c7c56eadLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:a:cisco:expressway:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    40 · node/0 · match 8
    Logic
    OR
    Version bounds
    through excluding x14.3.3
    Match ID
    6560dbf4-afe6-4672-95de-74a0b8f4170a

Affected-product evidence

Accepted scope and product mapping

0 canonical links · 0 source-reported links

Applicability remains source-scoped; safety and exposure remain unassessed.

Assessments

CVSS by origin

7.5
NVDCVSS 3.1 · role Primary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5
CVE Program sourceCVSS 3.1 · role Secondary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5
CISA-ADPCVSS 3.1 · role unknown · display onlyDirect record assessment retained outside normalized eligibilityCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Evidence boundaries

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; remaining scope stays source-scoped.
  • NVD-carried upstream facts remain derivative; independent corroboration requires a separately authored source.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Affected-product evidence remains source-scoped; canonical linkage is required before applicability scoring.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.
  • OSV aggregation and OSV-converted NVD material are not independent corroboration.
  • Red Hat facts are vendor assertions for the exact supplied products.
  • Nonmembership and not-yet-observed states are not proof of safety.