p PatchFirst

CVE-2023-43622

CVE-2023-43622 · Apache HTTP Server: DoS in HTTP/2 with initial windows size 0

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue.

CVSS 7.5 · High · EPSS 68.8% · Fix available

Published
Updated

Stack: system · web

Affected products and versions

  • apache httpd

    Versions
    • ≥ 2.4.55, ≤ 2.4.57: Affected (semver)

    No fix published

  • apache2 Debian:12

    Versions
    • 2.4.57-2
    • 2.4.57-3
    • 2.4.58-1
    • 2.4.59-1~deb10u1
    • 2.4.59-1~deb11u1
    Affected ranges
    • ECOSYSTEM: < 2.4.59-1~deb12u1

    Update to 2.4.59-1~deb12u1

  • apache2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.4.58-1

    Update to 2.4.58-1

  • apache2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.4.58-1

    Update to 2.4.58-1

Original sources

Check your server →