In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade apache2 | Oct 30, 2018 | Sep 25, 2018 |
| Amazon Linux Ami 2 | — | Upgrade httpd-debuginfoUpgrade httpdUpgrade mod_ldapUpgrade mod_mdUpgrade mod_sslUpgrade mod_http2-debuginfoUpgrade httpd-filesystemUpgrade httpd-develUpgrade mod_sessionUpgrade httpd-toolsUpgrade mod_proxy_htmlUpgrade httpd-manualUpgrade mod_http2 | Apr 27, 2020 | Sep 25, 2018 |
| Amazon_linux | — | Upgrade httpd24 | Dec 15, 2018 | Sep 25, 2018 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Sep 26, 2018 | Sep 25, 2018 |
| Debian | — | Upgrade apache2 | Jul 30, 2024 | Sep 25, 2018 |
| Freebsd | — | Upgrade apache24 | Sep 27, 2018 | Sep 26, 2018 |
| Hpux | — | Update hpuxwsAPACHE to the latest version | Mar 28, 2022 | Sep 25, 2018 |
| Oracle Solaris | — | Upgrade web/server/apache-24/module/apache-security to version 2.9.2-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-gss to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-fcgid to version 2.3.9-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-jk to version 1.2.42-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-lua to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-perl to version 2.0.10-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-wsgi-35 to version 4.5.1-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24 to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl-fips-140 to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-wsgi-34 to version 4.5.1-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-wsgi-27 to version 4.5.1-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-wsgi to version 4.5.1-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-dbd to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-dtrace to version 0.3.1-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ldap to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl to version 2.4.37-11.4.5.0.1.2.0 on Solaris 11.4 | Feb 20, 2019 | Sep 25, 2018 |
| Suse | — | Upgrade virtualbox-vncUpgrade apache2-eventUpgrade virtualbox-develUpgrade apache2-preforkUpgrade virtualboxUpgrade virtualbox-guest-sourceUpgrade apache2Upgrade virtualbox-guest-x11Upgrade virtualbox-host-kmp-defaultUpgrade virtualbox-qtUpgrade apache2-utilsUpgrade apache2-develUpgrade virtualbox-guest-kmp-defaultUpgrade apache2-example-pagesUpgrade virtualbox-host-sourceUpgrade apache2-workerUpgrade virtualbox-websrvUpgrade virtualbox-guest-desktop-iconsUpgrade virtualbox-guest-toolsUpgrade apache2-docUpgrade python3-virtualbox | Oct 17, 2018 | Sep 25, 2018 |
| Ubuntu | — | Upgrade apache2-bin | Oct 16, 2018 | Sep 25, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 25, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub