When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that.
This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out.
Users are recommended to upgrade to version 2.4.58, which fixes the issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mod_ldapUpgrade mod_sessionUpgrade httpd-manualUpgrade mod_sslUpgrade mod_mdUpgrade mod_http2Upgrade httpd-filesystemUpgrade httpdUpgrade mod_proxy_htmlUpgrade httpd-develUpgrade httpd-tools | May 8, 2024 | Oct 23, 2023 |
| Alpine Linux | — | Upgrade apache2 | Mar 26, 2024 | Oct 23, 2023 |
| Amazon Linux Ami 2 | — | Upgrade httpd-manualUpgrade mod_sslUpgrade httpd-toolsUpgrade mod_mdUpgrade mod_proxy_htmlUpgrade httpd-debuginfoUpgrade mod_sessionUpgrade httpd-develUpgrade httpdUpgrade mod_ldapUpgrade httpd-filesystem | Nov 3, 2023 | Oct 23, 2023 |
| Amazon_linux | — | Upgrade httpd24 | Nov 4, 2023 | Oct 23, 2023 |
| Amazon_linux_2023 | — | Upgrade httpd-coreUpgrade mod_ssl-debuginfoUpgrade httpd-toolsUpgrade httpd-core-debuginfoUpgrade mod_ldap-debuginfoUpgrade mod_proxy_htmlUpgrade httpd-manualUpgrade httpd-debuginfoUpgrade httpd-tools-debuginfoUpgrade mod_ldapUpgrade mod_sslUpgrade httpd-filesystemUpgrade mod_proxy_html-debuginfoUpgrade mod_lua-debuginfoUpgrade httpd-debugsourceUpgrade mod_session-debuginfoUpgrade mod_luaUpgrade httpd-develUpgrade httpdUpgrade mod_session | Feb 17, 2025 | Oct 19, 2023 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Nov 29, 2023 | Oct 23, 2023 |
| Debian | — | Upgrade apache2 | Apr 18, 2024 | Oct 23, 2023 |
| Freebsd | — | Upgrade apache24 | Dec 10, 2025 | Oct 19, 2023 |
| Gentoo Linux | — | Upgrade www-servers/apache. | Aug 16, 2026 | Aug 13, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade mod_sslUpgrade httpd-toolsUpgrade httpd-filesystemUpgrade httpd | Jan 10, 2024 | Oct 23, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade httpd-filesystemUpgrade httpd-toolsUpgrade mod_sslUpgrade httpd | Jan 10, 2024 | Oct 23, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade httpd-filesystemUpgrade httpd-manualUpgrade mod_sslUpgrade mod_sessionUpgrade httpd-toolsUpgrade httpd-develUpgrade httpd | Mar 13, 2024 | Oct 23, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade httpd-toolsUpgrade httpdUpgrade httpd-filesystemUpgrade mod_ssl | Jan 10, 2024 | Oct 23, 2023 |
| Oracle_linux | — | Upgrade httpd-toolsUpgrade httpd-manualUpgrade mod_mdUpgrade httpd-develUpgrade httpdUpgrade mod_sslUpgrade httpd-filesystemUpgrade mod_proxy_htmlUpgrade mod_sessionUpgrade mod_ldapUpgrade mod_http2 | May 8, 2024 | Oct 19, 2023 |
| Redhat_linux | — | Upgrade httpd-filesystemUpgrade mod_mdUpgrade httpdUpgrade httpd-debuginfoUpgrade mod_sessionUpgrade mod_md-debuginfoUpgrade httpd-tools-debuginfoUpgrade mod_sslUpgrade mod_http2-debuginfoUpgrade mod_md-debugsourceUpgrade httpd-develNo solution existsUpgrade httpd-debugsourceUpgrade httpd-toolsUpgrade mod_ldapUpgrade mod_http2-debugsourceUpgrade mod_proxy_htmlUpgrade httpd-manualUpgrade mod_proxy_html-debuginfoUpgrade mod_ssl-debuginfoUpgrade mod_session-debuginfoUpgrade mod_ldap-debuginfoUpgrade mod_http2 | May 1, 2024 | Oct 23, 2023 |
| Rocky_linux | — | Upgrade mod_sessionUpgrade httpdUpgrade mod_ldap-debuginfoUpgrade httpd-debuginfoUpgrade httpd-debugsourceUpgrade mod_ldapUpgrade mod_md-debuginfoUpgrade mod_proxy_html-debuginfoUpgrade httpd-tools-debuginfoUpgrade httpd-develUpgrade mod_sslUpgrade mod_http2-debuginfoUpgrade mod_mdUpgrade mod_session-debuginfoUpgrade mod_ssl-debuginfoUpgrade mod_http2-debugsourceUpgrade mod_proxy_htmlUpgrade mod_http2Upgrade httpd-toolsUpgrade mod_md-debugsource | Jun 17, 2024 | Oct 23, 2023 |
| Ubuntu | — | Upgrade apache2 (Ubuntu Pro)Upgrade apache2 | Nov 23, 2023 | Oct 23, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 23, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub