Published: 23/10/2023 Updated: 21/11/2024

HTTP/2 Memory Exhaustion Vulnerability in CVE-2023-44487 Exploit

When a client reset a HTTP/2 stream (using a RST frame), there was a delay in releasing the request's memory. Memory wasn't freed right away but waited until the connection was closed. A client could keep sending new requests and resets, which kept the connection active and increased the memory usage. When the connection finally closed, all memory was freed. However, there was a risk of running out of memory before that happened. This issue was discovered while testing CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with a custom test client. Under typical HTTP/2 usage, this bug is not likely to cause problems. The increased memory isn't noticed until the connection ends or times out. It's advised to upgrade to version 2.4.58 to fix this issue.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache http server
fedoraproject fedora 37
fedoraproject fedora 38
fedoraproject fedora 39
debian debian linux 10.0

概述 Important: Red Hat JBoss Core Services Apache HTTP Server 2457 SP2 security update 类型/严重性 Security Advisory: Important 标题 Red Hat JBoss Core Services Apache HTTP Server 2457 Service Pack 2 is now availableRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability S ...

概述 Important: Red Hat JBoss Core Services Apache HTTP Server 2457 SP2 security update 类型/严重性 Security Advisory: Important Red Hat Insights 补丁分析识别并修复受此公告影响的系统。查看受影响的系统标题 An update is now available for Red Hat JBoss Core ServicesRed Hat Product Security has ...

Out-of-bounds Read vulnerability in mod_macro of Apache HTTP ServerThis issue affects Apache HTTP Server: through 2457 (CVE-2023-31122) A flaw was found in httpd This flaw allows an attacker opening an HTTP/2 connection with an initial window size of 0 to block handling of that connection indefinitely in the Apache HTTP Server This vulnerabil ...

A vulnerability (CVE-2023-45802) exists in Cosminexus HTTP Server Affected products and versions are listed below Please upgrade your version to the appropriate version ...

Critical Infrastructure Sectors: Critical Manufacturing

Denial of Service (DoS) Medium Article Demonstration Description Thisproject serves as a Proof of Concept (POC) for exploiting a Denial of Service (DoS) vulnerability, CVE-2023–43622, in Apache HTTP Server versions prior to 2458 Utilizing a Python script, the project demonstrates how manipulating the window size in HTTP/2 connections can lead to server resource exhaust

HTTP/2 vulnerabilities This operator uses the latest version of docker image with Apache HTTPD server v2458 on date 2/12/2023 That version contains fixes for CVE-2023-45802, CVE-2023-43622 and CVE-2023-31122 About Apacheweb operator Apacheweb operator is powered by Apache HTTP server Apacheweb operator provides basic features of Apache HTTP server - web server and load balan

CWE-404 CWE-404 https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2023:7626 https://www.first.org/epss https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-06 https://alas.aws.amazon.com/AL2/ALAS-2023-2322.html https://httpd.apache.org/security/vulnerabilities_24.html https://httpd.apache.org/security/vulnerabilities_24.html https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/https://security.netapp.com/advisory/ntap-20231027-0011/

CVE-2023-45802

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect