Summary
[2.0.26-1]
- Resolves: RHEL-14691 - mod_http2 rebase to 2.0.26
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | mod_http2 | 0:2.0.26-1.el9 |
Vulnerabilities 2
-
Unscored —
Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" a…
-
Unscored —CVE-2023-45802 Public exploit
Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping t…