A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.
CVSS Details
- CVSS 3.1 Base Score: 4.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-mod_md | May 4, 2022 | Jun 11, 2019 | |
| Alpine Linux | alpine-linux-upgrade-apache2 | Jun 11, 2019 | Jun 11, 2019 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-httpdamazon-linux-ami-2-upgrade-httpd-debuginfoamazon-linux-ami-2-upgrade-httpd-develamazon-linux-ami-2-upgrade-httpd-filesystemamazon-linux-ami-2-upgrade-httpd-manualamazon-linux-ami-2-upgrade-httpd-toolsamazon-linux-ami-2-upgrade-mod_ldapamazon-linux-ami-2-upgrade-mod_mdamazon-linux-ami-2-upgrade-mod_proxy_htmlamazon-linux-ami-2-upgrade-mod_sessionamazon-linux-ami-2-upgrade-mod_ssl | Apr 27, 2020 | Jun 11, 2019 | |
| Amazon_linux | — | amazon-linux-upgrade-httpd24 | Aug 7, 2019 | Apr 5, 2019 |
| Apache Httpd | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | apache-httpd-upgrade-latest | Jun 11, 2019 | Jun 11, 2019 |
| Arch Linux | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | arch-linux-upgrade-latest | Jul 11, 2025 | Jun 11, 2019 |
| Centos_linux | — | centos-upgrade-httpdcentos-upgrade-httpd-debuginfocentos-upgrade-httpd-debugsourcecentos-upgrade-httpd-develcentos-upgrade-httpd-filesystemcentos-upgrade-httpd-manualcentos-upgrade-httpd-toolscentos-upgrade-httpd-tools-debuginfocentos-upgrade-mod_http2centos-upgrade-mod_http2-debuginfocentos-upgrade-mod_http2-debugsourcecentos-upgrade-mod_ldapcentos-upgrade-mod_ldap-debuginfocentos-upgrade-mod_mdcentos-upgrade-mod_md-debuginfocentos-upgrade-mod_md-debugsourcecentos-upgrade-mod_proxy_htmlcentos-upgrade-mod_proxy_html-debuginfocentos-upgrade-mod_sessioncentos-upgrade-mod_session-debuginfocentos-upgrade-mod_sslcentos-upgrade-mod_ssl-debuginfo | Nov 5, 2020 | Jun 11, 2019 |
| Debian | debian-upgrade-apache2 | Jul 30, 2024 | Jun 11, 2019 | |
| Hpux | — | hpux-update-hpuxwsapache | Sep 16, 2019 | Jun 11, 2019 |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-httpdhuawei-euleros-2_0_sp8-upgrade-httpd-develhuawei-euleros-2_0_sp8-upgrade-httpd-filesystemhuawei-euleros-2_0_sp8-upgrade-httpd-manualhuawei-euleros-2_0_sp8-upgrade-httpd-toolshuawei-euleros-2_0_sp8-upgrade-mod_sessionhuawei-euleros-2_0_sp8-upgrade-mod_ssl | Mar 24, 2020 | Jun 11, 2019 | |
| Ibm Http_server | — | ibm-http_server-apply-fix-pack-9_0_5_0 | Nov 5, 2019 | Jun 11, 2019 |
| Oracle Solaris | oracle-solaris-11-3-upgrade-web-server-apache-24-2-4-39-0-175-3-36-0-11-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-dbd-2-4-39-0-175-3-36-0-11-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-gss-2-4-39-0-175-3-36-0-11-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ldap-2-4-39-0-175-3-36-0-11-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-lua-2-4-39-0-175-3-36-0-11-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ssl-2-4-39-0-175-3-36-0-11-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ssl-fips-140-2-4-39-0-175-3-36-0-11-0oracle-solaris-11-4-upgrade-web-server-apache-24-2-4-39-11-4-9-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-dbd-2-4-39-11-4-9-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-gss-2-4-39-11-4-9-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-ldap-2-4-39-11-4-9-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-lua-2-4-39-11-4-9-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-ssl-2-4-39-11-4-9-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-ssl-fips-140-2-4-39-11-4-9-0-1-1-0 | May 30, 2019 | May 30, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-httpdoracle-linux-upgrade-httpd-develoracle-linux-upgrade-httpd-filesystemoracle-linux-upgrade-httpd-manualoracle-linux-upgrade-httpd-toolsoracle-linux-upgrade-mod-http2oracle-linux-upgrade-mod-ldaporacle-linux-upgrade-mod-mdoracle-linux-upgrade-mod-proxy-htmloracle-linux-upgrade-mod-sessionoracle-linux-upgrade-mod-ssl | Nov 12, 2020 | Feb 1, 2019 |
| Redhat_linux | redhat-upgrade-httpdredhat-upgrade-httpd-debuginforedhat-upgrade-httpd-debugsourceredhat-upgrade-httpd-develredhat-upgrade-httpd-filesystemredhat-upgrade-httpd-manualredhat-upgrade-httpd-toolsredhat-upgrade-httpd-tools-debuginforedhat-upgrade-mod_http2redhat-upgrade-mod_http2-debuginforedhat-upgrade-mod_http2-debugsourceredhat-upgrade-mod_ldapredhat-upgrade-mod_ldap-debuginforedhat-upgrade-mod_mdredhat-upgrade-mod_md-debuginforedhat-upgrade-mod_md-debugsourceredhat-upgrade-mod_proxy_htmlredhat-upgrade-mod_proxy_html-debuginforedhat-upgrade-mod_sessionredhat-upgrade-mod_session-debuginforedhat-upgrade-mod_sslredhat-upgrade-mod_ssl-debuginfo | Nov 5, 2020 | Jun 11, 2019 | |
| Rocky_linux | rocky-upgrade-mod_mdrocky-upgrade-mod_md-debuginforocky-upgrade-mod_md-debugsource | Mar 12, 2024 | Jun 11, 2019 | |
| Suse | — | suse-upgrade-apache2suse-upgrade-apache2-develsuse-upgrade-apache2-docsuse-upgrade-apache2-eventsuse-upgrade-apache2-example-pagessuse-upgrade-apache2-preforksuse-upgrade-apache2-utilssuse-upgrade-apache2-worker | Apr 5, 2019 | Apr 4, 2019 |
| Ubuntu | ubuntu-upgrade-apache2ubuntu-upgrade-apache2-bin | Aug 30, 2019 | Apr 5, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub