In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade apache2 | Oct 30, 2018 | Sep 25, 2018 |
| Amazon Linux Ami 2 | — | Upgrade httpd-develUpgrade httpd-toolsUpgrade mod_sessionUpgrade mod_http2-debuginfoUpgrade mod_proxy_htmlUpgrade mod_sslUpgrade mod_mdUpgrade mod_http2Upgrade httpd-filesystemUpgrade httpd-manualUpgrade httpdUpgrade httpd-debuginfoUpgrade mod_ldap | Apr 27, 2020 | Sep 25, 2018 |
| Amazon_linux | — | Upgrade httpd24 | Dec 15, 2018 | Sep 25, 2018 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Sep 26, 2018 | Sep 25, 2018 |
| Debian | — | Upgrade apache2 | Jul 30, 2024 | Sep 25, 2018 |
| Freebsd | — | Upgrade apache24 | Sep 27, 2018 | Sep 26, 2018 |
| Hpux | — | Update hpuxwsAPACHE to the latest version | Mar 28, 2022 | Sep 25, 2018 |
| Oracle Solaris | — | Upgrade web/server/apache-24/module/apache-dtrace to version 0.3.1-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ldap to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-dbd to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl-fips-140 to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-wsgi-27 to version 4.5.1-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-wsgi to version 4.5.1-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-wsgi-34 to version 4.5.1-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-wsgi-35 to version 4.5.1-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-perl to version 2.0.10-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-lua to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-fcgid to version 2.3.9-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-security to version 2.9.2-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-jk to version 1.2.42-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-gss to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24 to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4 | Feb 20, 2019 | Sep 25, 2018 |
| Suse | — | Upgrade virtualbox-host-kmp-defaultUpgrade virtualbox-guest-sourceUpgrade virtualbox-vncUpgrade virtualbox-qtUpgrade virtualbox-guest-x11Upgrade virtualboxUpgrade apache2-eventUpgrade virtualbox-develUpgrade apache2Upgrade apache2-preforkUpgrade apache2-utilsUpgrade virtualbox-host-sourceUpgrade apache2-docUpgrade virtualbox-guest-toolsUpgrade python3-virtualboxUpgrade apache2-example-pagesUpgrade virtualbox-guest-kmp-defaultUpgrade apache2-workerUpgrade virtualbox-websrvUpgrade apache2-develUpgrade virtualbox-guest-desktop-icons | Oct 17, 2018 | Sep 25, 2018 |
| Ubuntu | — | Upgrade apache2-bin | Oct 16, 2018 | Sep 25, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 25, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub