Apache HTTP Server HTTP/2 Window Size 0 Denial of Service (v2.4.5557): CVE-2023-43622 October 2023

Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue.

Timeline

Weakness Type

What is a Resource Exhaustion Vulnerability?

The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

CVE-2023-43622 has been classified to as a Resource Exhaustion vulnerability or weakness.

Products Associated with CVE-2023-43622

stack.watch emails you whenever new vulnerabilities are published in Apache HTTP Server or Canonical Ubuntu Linux. Just hit a watch button to start following.

Affected Versions

Exploit Probability

EPSS

62.34%

Percentile

98.34%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.