Description
The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache2 | 2.4.10-10 | — |
| Debian 13 | apache2 | 2.4.10-10 | — |
| Debian 12 | apache2 | 2.4.10-10 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 2 | httpd24-httpd +5 | 2.4.12-4.el6.2 | RHSA-2015:1666 |
| RHEL 2 | httpd24-mod_ssl +1 | 1:2.4.12-4.el6.2 | RHSA-2015:1666 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | apache2 | 2.4.10-12.1 | SUSE-SU-2015:0974-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 | apache2 | 2.4.10-12.1 | SUSE-SU-2015:0974-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2 | 2.4.23-4.1 | openSUSE-SU-2024:10268-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | httpd24-httpd +5 | 2.4.12-6.0.1.el7.1 | ELSA-2015-1666 |
| Oracle Linux 7 | httpd24-mod_ssl +1 | 1:2.4.12-6.0.1.el7.1 | ELSA-2015-1666 |
Advisories 4
- RHSA-2015:1666 Red Hat Security Advisory: httpd24-httpd security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- SUSE-SU-2015:0974-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10268-1 apache2-2.4.23-4.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2015-1666 Moderate: httpd24-httpd security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 4, 2016
References
- openSUSE-SU-2015:0418 vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://advisories.mageia.org/MGASA-2015-0099.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- USN-2523-1 vendor-advisory
- http://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x/CHANGES
- RHSA-2015:1666 vendor-advisory
- 1032967 vdb-entry
- https://github.com/apache/httpd/commit/643f0fcf3b8ab09a68f0ecd2aa37aafeda3e63ef
- APPLE-SA-2015-08-13-2 vendor-advisory
- 91787 vdb-entry
- https://support.apple.com/kb/HT205031
- APPLE-SA-2015-09-16-4 vendor-advisory
- https://support.apple.com/HT205219
- 73041 vdb-entry
- [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- https://github.com/apache/httpd/commit/78eb3b9235515652ed141353d98c239237030410
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [9/13] - /httpd/site/trunk/content/security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [10/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list