In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade apache2 | Oct 30, 2018 | Sep 25, 2018 |
| Amazon Linux Ami 2 | — | Upgrade mod_ldapUpgrade httpdUpgrade httpd-debuginfoUpgrade httpd-develUpgrade httpd-toolsUpgrade mod_proxy_htmlUpgrade mod_http2-debuginfoUpgrade mod_sslUpgrade httpd-manualUpgrade httpd-filesystemUpgrade mod_http2Upgrade mod_mdUpgrade mod_session | Apr 27, 2020 | Sep 25, 2018 |
| Amazon_linux | — | Upgrade httpd24 | Dec 15, 2018 | Sep 25, 2018 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Sep 26, 2018 | Sep 25, 2018 |
| Debian | — | Upgrade apache2 | Jul 30, 2024 | Sep 25, 2018 |
| Freebsd | — | Upgrade apache24 | Sep 27, 2018 | Sep 26, 2018 |
| Hpux | — | Update hpuxwsAPACHE to the latest version | Mar 28, 2022 | Sep 25, 2018 |
| Oracle Solaris | — | Upgrade web/server/apache-24/module/apache-fcgid to version 2.3.9-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-perl to version 2.0.10-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24 to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-lua to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-gss to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-jk to version 1.2.42-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-wsgi-35 to version 4.5.1-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-security to version 2.9.2-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ldap to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-wsgi-27 to version 4.5.1-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-dtrace to version 0.3.1-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl-fips-140 to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-wsgi to version 4.5.1-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-wsgi-34 to version 4.5.1-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-dbd to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4 | Feb 20, 2019 | Sep 25, 2018 |
| Suse | — | Upgrade apache2-workerUpgrade apache2-docUpgrade virtualbox-host-sourceUpgrade virtualbox-guest-toolsUpgrade apache2-example-pagesUpgrade python3-virtualboxUpgrade virtualbox-guest-kmp-defaultUpgrade virtualbox-guest-desktop-iconsUpgrade virtualbox-websrvUpgrade apache2-develUpgrade virtualbox-develUpgrade virtualbox-vncUpgrade virtualbox-qtUpgrade apache2-utilsUpgrade virtualbox-guest-sourceUpgrade virtualbox-guest-x11Upgrade virtualbox-host-kmp-defaultUpgrade apache2Upgrade apache2-eventUpgrade virtualboxUpgrade apache2-prefork | Oct 17, 2018 | Sep 25, 2018 |
| Ubuntu | — | Upgrade apache2-bin | Oct 16, 2018 | Sep 25, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 25, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub