Skip to content
OpenAdvisories
Unscored Public exploit CVE-2023-43622 EUVD-2023-48022GHSA-w2qc-22jv-44g8

Apache HTTP Server: DoS in HTTP/2 with initial windows size 0

Published Oct 23, 2023 · Updated Feb 13, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache HTTP Server Package: apache2 Package: apache2 Package: httpd Package: mod_http2 Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian

Description

An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern.
This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.

This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.

Users are recommended to upgrade to version 2.4.58, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache HTTP Server 2.4.55 – ≤ 2.4.57 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 apache2 2.4.58-1 —
Debian 13 apache2 2.4.58-1 —
Debian 12 apache2 2.4.59-1~deb12u1 DSA-5662-1
Debian 11 apache2 2.4.59-1~deb11u1 DSA-5662-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS apache2 2.4.52-1ubuntu4.7 USN-6506-1
Ubuntu 20.04 LTS apache2 2.4.41-4ubuntu3.15 USN-6506-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 mod_http2 2.0.26-1.el9 RHSA-2024:2368

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 mod_http2 2.0.26-1.el9 ALSA-2024:2368

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed apache2 2.4.58-1.1 openSUSE-SU-2024:13350-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 apache2 2.4.58-r0 —
Alpine v3.23 apache2 2.4.58-r0 —
Alpine v3.22 apache2 2.4.58-r0 —
Alpine v3.21 apache2 2.4.58-r0 —
Alpine v3.20 apache2 2.4.58-r0 —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 apache2 2.4.58-r0 —
Alpine v3.18 apache2 2.4.58-r0 —
Alpine v3.17 apache2 2.4.58-r0 —
Alpine v3.16 apache2 2.4.58-r0 —
Alpine v3.15 apache2 2.4.58-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 httpd +8 2.4.58-1.amzn2023 ALAS2023-2023-433
Amazon Linux 2023 mod_ssl +1 1:2.4.58-1.amzn2023 ALAS2023-2023-433
Amazon Linux 2 httpd +7 2.4.58-1.amzn2 ALAS2-2023-2322
Amazon Linux 2 mod_ssl +1 1:2.4.58-1.amzn2 ALAS2-2023-2322

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 mod_http2 2.0.29-3 —
Azure Linux 2 (CBL-Mariner) httpd 2.4.58-1 —
Azure Linux 2 (CBL-Mariner) mod_http2 No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 mod_http2 2.0.26-1.el9 ELSA-2024-2368

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 17

References