Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mod_http2 | Nov 4, 2024 | Jul 1, 2024 |
| Alpine Linux | — | Upgrade apache2 | Aug 22, 2024 | Jul 1, 2024 |
| Amazon_linux_2023 | — | Upgrade mod_http2Upgrade mod_http2-debugsourceUpgrade mod_http2-debuginfo | Feb 17, 2025 | Jul 1, 2024 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Oct 14, 2024 | Jul 1, 2024 |
| Debian | — | Upgrade apache2 | Jul 15, 2024 | Jul 1, 2024 |
| Freebsd | — | Upgrade apache24 | Jul 2, 2024 | Jul 1, 2024 |
| Gentoo Linux | — | Upgrade www-servers/apache. | Sep 30, 2024 | Jul 1, 2024 |
| Oracle_linux | — | Upgrade mod_http2 | Nov 11, 2024 | Jul 1, 2024 |
| Redhat_linux | — | Upgrade mod_http2-debugsourceUpgrade mod_http2-debuginfoUpgrade mod_http2 | Nov 4, 2024 | Jul 1, 2024 |
| Rocky_linux | — | Upgrade mod_http2-debugsourceUpgrade mod_http2-debuginfoUpgrade mod_http2 | Nov 19, 2024 | Jul 1, 2024 |
| Suse | — | Upgrade apache2-preforkUpgrade apache2-develUpgrade apache2-manualUpgrade apache2-utilsUpgrade apache2-eventUpgrade apache2-workerUpgrade apache2 | Jul 24, 2024 | Jul 1, 2024 |
| Ubuntu | — | Upgrade apache2 | Jul 9, 2024 | Jul 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub