The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of service (stream-processing outage) via modified flow-control windows.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Jul 6, 2016 | Jul 6, 2016 |
| Debian | — | Upgrade apache2 | Jul 30, 2024 | Jul 6, 2016 |
| Gentoo Linux | — | Upgrade www-servers/apache. | Oct 30, 2017 | Jul 6, 2016 |
| Ibm Http_server | — | Apply IBM HTTP Server version 9.0.0.0 or later | Jun 22, 2018 | Jul 6, 2016 |
| Oracle Solaris | — | Upgrade web/server/apache-24/module/apache-ldap to version 2.4.23-0.175.3.13.0.1.0 on Solaris 11.3Upgrade web/server/apache-22 to version 2.2.31-0.175.3.13.0.1.0 on Solaris 11.3Upgrade web/server/apache-24/module/apache-lua to version 2.4.23-0.175.3.13.0.1.0 on Solaris 11.3Upgrade web/server/apache-24 to version 2.4.23-0.175.3.13.0.1.0 on Solaris 11.3Upgrade web/server/apache-22/module/apache-sed to version 2.2.31-0.175.3.13.0.1.0 on Solaris 11.3Upgrade web/server/apache-22/documentation to version 2.2.31-0.175.3.13.0.1.0 on Solaris 11.3Upgrade web/server/apache-24/module/apache-dbd to version 2.4.23-0.175.3.13.0.1.0 on Solaris 11.3Upgrade web/server/apache-24/module/apache-ssl to version 2.4.23-0.175.3.13.0.1.0 on Solaris 11.3Upgrade web/server/apache-24/module/apache-ssl-fips-140 to version 2.4.23-0.175.3.13.0.1.0 on Solaris 11.3 | May 29, 2017 | Jul 6, 2016 |
| Suse | — | Upgrade apache2-utilsUpgrade apache2-workerUpgrade apache2-docUpgrade apache2-preforkUpgrade apache2-example-pagesUpgrade apache2-develUpgrade apache2 | Dec 9, 2016 | Jul 6, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub