Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Apache HTTP Server Uncontrolled Resource Consumption Vulnerability - CVE-2023-43622 - Vulnerability Database
Apache HTTP Server

Apache HTTP Server Uncontrolled Resource Consumption Vulnerability - CVE-2023-43622

High
Reference: CVE-2023-43622
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2023-43622
Title: Apache HTTP Server Uncontrolled Resource Consumption Vulnerability
Overview:

An attacker opening a HTTP/2 connection with an initial window size of 0 was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server similar to the well known quotslow lorisquot attack pattern. This has been fixed in version 2.4.58 so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58 which fixes the issue.