Published: 23/10/2023 Updated: 21/11/2024

An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 up to and including 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache http server

Out-of-bounds Read vulnerability in mod_macro of Apache HTTP ServerThis issue affects Apache HTTP Server: through 2457 (CVE-2023-31122) A flaw was found in httpd This flaw allows an attacker opening an HTTP/2 connection with an initial window size of 0 to block handling of that connection indefinitely in the Apache HTTP Server This vulnerabil ...

Check Point Reference: CPAI-2023-1146 Date Published: 11 Sep 2024 Severity: High ...

Critical Infrastructure Sectors: Critical Manufacturing

Apache HTTP Server Medium Article Demonstration Description This project showcases a Python script aimed at understanding and exploiting a Denial of Service (DoS) vulnerability, specifically CVE-2023–43622, found in Apache HTTP Server versions prior to 2458 The vulnerability involves manipulating the initial window size in HTTP/2 connections, potentially causing serve

Hi, Friends 👋 I'm Sebastien! I'm a cybersecurity professional who enjoys learning This is a space where I showcase my projects 👨‍💻 Cybersecurity Projects: Wazuh Wazuh (Intrusion Detection System) PowerShell Windows EventLog: Failed RDP Logins Source IP to full GeoData Conversion Active Directory Bulk User Creation Python FIM (File Integrity Mon

HTTP/2 vulnerabilities This operator uses the latest version of docker image with Apache HTTPD server v2458 on date 2/12/2023 That version contains fixes for CVE-2023-45802, CVE-2023-43622 and CVE-2023-31122 About Apacheweb operator Apacheweb operator is powered by Apache HTTP server Apacheweb operator provides basic features of Apache HTTP server - web server and load balan

Denial of Service (DoS) Medium Article Demonstration Description Thisproject serves as a Proof of Concept (POC) for exploiting a Denial of Service (DoS) vulnerability, CVE-2023–43622, in Apache HTTP Server versions prior to 2458 Utilizing a Python script, the project demonstrates how manipulating the window size in HTTP/2 connections can lead to server resource exhaust

CWE-400 https://nvd.nist.gov https://alas.aws.amazon.com/AL2/ALAS-2023-2322.html https://www.first.org/epss https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-06 https://httpd.apache.org/security/vulnerabilities_24.html https://security.netapp.com/advisory/ntap-20231027-0011/https://httpd.apache.org/security/vulnerabilities_24.html https://security.netapp.com/advisory/ntap-20231027-0011/

CVE-2023-43622

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect