The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade apache2 | Mar 26, 2024 | Jun 15, 2021 |
| Amazon Linux Ami 2 | — | Upgrade mod_mdUpgrade httpd-manualUpgrade mod_http2Upgrade mod_proxy_htmlUpgrade mod_sessionUpgrade httpd-toolsUpgrade httpd-filesystemUpgrade mod_ldapUpgrade httpd-debuginfoUpgrade httpdUpgrade httpd-develUpgrade mod_http2-debuginfoUpgrade mod_ssl | Jun 24, 2021 | Jun 15, 2021 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Dec 22, 2021 | Jun 15, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 15, 2021 |
| Check Point Gaia | — | Upgrade to supported version Check Point Gaia. | Feb 25, 2026 | Oct 27, 2021 |
| Debian | — | Upgrade apache2 | Jul 12, 2021 | Jun 15, 2021 |
| Freebsd | — | Upgrade apache24 | Nov 4, 2022 | Jun 10, 2021 |
| Gentoo Linux | — | Upgrade www-servers/apache. | Jul 19, 2021 | Jun 15, 2021 |
| Oracle Solaris | — | Upgrade web/server/apache-24/module/apache-gss to version 2.4.48-11.4.35.0.1.94.3 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ldap to version 2.4.48-11.4.35.0.1.94.3 on Solaris 11.4Upgrade web/server/apache-24/module/apache-dbd to version 2.4.48-11.4.35.0.1.94.3 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl to version 2.4.48-11.4.35.0.1.94.3 on Solaris 11.4Upgrade web/server/apache-24 to version 2.4.48-11.4.35.0.1.94.3 on Solaris 11.4Upgrade web/server/apache-24/module/apache-lua to version 2.4.48-11.4.35.0.1.94.3 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl-fips-140 to version 2.4.48-11.4.35.0.1.94.3 on Solaris 11.4 | Jul 21, 2021 | Jun 15, 2021 |
| Suse | — | Upgrade apache2Upgrade apache2-workerUpgrade apache2-preforkUpgrade apache2-utilsUpgrade apache2-eventUpgrade apache2-docUpgrade apache2-develUpgrade apache2-example-pages | Jun 19, 2021 | Jun 15, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub