{"id":"CVE-2023-43622","aliases":["ALPINE-CVE-2023-43622","ALSA-2024:2368","AZL-31610","AZL-43639","AZL-44955","BELL-CVE-2023-43622","BIT-apache-2023-43622","DEBIAN-CVE-2023-43622","DSA-5662-1","EUVD-2023-48022","GHSA-w2qc-22jv-44g8","MGASA-2023-0304","RHSA-2024:2368","UBUNTU-CVE-2023-43622","USN-6506-1","openSUSE-SU-2024:13350-1"],"status":"published","title":"Apache HTTP Server: DoS in HTTP/2 with initial windows size 0","description":"An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known \"slow loris\" attack pattern.\nThis has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.\n\nUsers are recommended to upgrade to version 2.4.58, which fixes the issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.68818,"percentile":0.99353,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-400"],"published":"2023-10-21T05:58:22.334636Z","modified":"2026-10-29T11:31:07Z","exploits":[{"source":"pocgithub","id":"visudade/CVE-2023-43622","title":"visudade/CVE-2023-43622","date":"2024-05-29","url":"https://github.com/visudade/CVE-2023-43622"}],"fixes":[{"ecosystem":"Alpine:v3.15","package":"apache2","fixed_in":["2.4.58-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"apache2","fixed_in":["2.4.58-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"apache2","fixed_in":["2.4.58-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"apache2","fixed_in":["2.4.58-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"apache2","fixed_in":["2.4.58-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"apache2","fixed_in":["2.4.58-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"apache2","fixed_in":["2.4.58-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"apache2","fixed_in":["2.4.58-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"apache2","fixed_in":["2.4.58-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"apache2","fixed_in":["2.4.58-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"httpd","fixed_in":["2.4.58-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"mod_http2","fixed_in":["2.0.29-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"apache2","fixed_in":["2.4.58-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"apache2","fixed_in":["2.4.58-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"apache","fixed_in":["2.4.58"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"apache2","fixed_in":["2.4.59-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apache2","fixed_in":["2.4.58-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apache2","fixed_in":["2.4.58-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.15","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.26-1.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:2","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.15.14-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.29-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.56-r0"},{"fixed":"2.4.58-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.56-r0"},{"fixed":"2.4.58-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"apache","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.55"},{"fixed":"2.4.58"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb12u1"}]}],"versions":["2.4.57-2","2.4.57-3","2.4.58-1","2.4.59-1~deb10u1","2.4.59-1~deb11u1"]},{"source":"osv","ecosystem":"Debian:13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb11u1"}]}],"versions":["2.4.48-3.1","2.4.48-3.1+deb11u1","2.4.48-4","2.4.49-1","2.4.49-1~bpo10+1","2.4.49-1~deb11u1","2.4.49-1~deb11u2","2.4.49-1~deb11u3","2.4.49-2","2.4.49-3","2.4.49-4","2.4.50-1","2.4.50-1~deb11u1","2.4.51-1","2.4.51-1~bpo10+1","2.4.51-1~bpo10+2","2.4.51-1~deb11u1","2.4.51-2","2.4.52-1","2.4.52-1~bpo10+1","2.4.52-1~deb11u1","2.4.52-1~deb11u2","2.4.52-2","2.4.52-3","2.4.53-1","2.4.53-1~deb11u1","2.4.53-2","2.4.53-2~bpo10+1","2.4.54-1","2.4.54-1~deb11u1","2.4.54-2","2.4.54-3","2.4.54-4","2.4.54-5","2.4.55-1","2.4.56-1","2.4.56-1~deb11u1","2.4.56-1~deb11u2","2.4.56-2","2.4.57-1","2.4.57-2","2.4.57-3","2.4.58-1","2.4.59-1~deb10u1"],"bundled":6},{"source":"osv","ecosystem":"Debian:12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb12u1"}]}],"versions":["2.4.57-2","2.4.57-3","2.4.58-1","2.4.59-1~deb10u1","2.4.59-1~deb11u1"],"bundled":6},{"source":"osv","ecosystem":"Mageia:8","package":"apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.26-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.26-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_http2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.26-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.15"}]}],"versions":["2.4.41-1ubuntu1","2.4.41-4ubuntu1","2.4.41-4ubuntu2","2.4.41-4ubuntu3","2.4.41-4ubuntu3.1","2.4.41-4ubuntu3.3","2.4.41-4ubuntu3.4","2.4.41-4ubuntu3.5","2.4.41-4ubuntu3.6","2.4.41-4ubuntu3.7","2.4.41-4ubuntu3.8","2.4.41-4ubuntu3.9","2.4.41-4ubuntu3.10","2.4.41-4ubuntu3.11","2.4.41-4ubuntu3.12","2.4.41-4ubuntu3.13","2.4.41-4ubuntu3.14"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.52-1ubuntu4.7"}]}],"versions":["2.4.48-3.1ubuntu3","2.4.48-3.1ubuntu4","2.4.51-2ubuntu1","2.4.52-1ubuntu1","2.4.52-1ubuntu2","2.4.52-1ubuntu4","2.4.52-1ubuntu4.1","2.4.52-1ubuntu4.2","2.4.52-1ubuntu4.3","2.4.52-1ubuntu4.4","2.4.52-1ubuntu4.5","2.4.52-1ubuntu4.6"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-1.1"}]}],"bundled":4}],"products":[{"vendor":"apache","product":"http_server"},{"vendor":"apache software foundation","product":"apache http server"}],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["vendor-advisory","x_transferred","Vendor Advisory","advisory","article"]},{"url":"https://security.netapp.com/advisory/ntap-20231027-0011/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43622","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20231027-0011"},{"url":"https://github.com/advisories/GHSA-w2qc-22jv-44g8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-43622","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2368","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-43622","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45802","tags":["report"]},{"url":"https://bugzilla.redhat.com/2243877","tags":["report"]},{"url":"https://bugzilla.redhat.com/2245153","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2368.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-43622","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43622.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-43622","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0304.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32415","tags":["report"]},{"url":"https://downloads.apache.org/httpd/CHANGES_2.4.58","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245153","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-14691","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2368.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-43622","tags":["advisory","report"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2023-43622","tags":["article","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45802","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45802","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-43622","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/10/19/5","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6506-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-31122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45802","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45802","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-43622","title":"Apache HTTP Server: DoS in HTTP/2 with initial windows size 0","description":"An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known \"slow loris\" attack pattern.\nThis has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.\n\nUsers are recommended to upgrade to version 2.4.58, which fixes the issue.","status":"published","published":"2023-10-23T06:50:51.555Z","modified":"2025-02-13T17:13:24.282Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:35:14.633899Z"}],"euvd":[{"id":"EUVD-2023-48022","description":"An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known \"slow loris\" attack pattern.\nThis has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.\n\nUsers are recommended to upgrade to version 2.4.58, which fixes the issue.","status":"published","published":"2023-10-23T06:50:51Z","modified":"2025-02-13T17:13:24Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"none"}],"updated_at":"2026-11-03T00:03:48.562419Z"}],"ghsa":[{"id":"GHSA-w2qc-22jv-44g8","title":"An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block...","description":"An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known \"slow loris\" attack pattern.\nThis has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.\n\nUsers are recommended to upgrade to version 2.4.58, which fixes the issue.","status":"published","published":"2023-10-23T09:30:18Z","modified":"2025-02-13T18:33:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:59:55.900946Z"}],"nvd":[{"id":"CVE-2023-43622","description":"An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known \"slow loris\" attack pattern.\nThis has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.\n\nUsers are recommended to upgrade to version 2.4.58, which fixes the issue.","status":"published","published":"2023-10-23T07:15:11.243Z","modified":"2026-06-17T06:26:05.477Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:08:39.058878Z"}],"osv":[{"id":"ALPINE-CVE-2023-43622","description":"An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known \"slow loris\" attack pattern.\nThis has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.\n\nUsers are recommended to upgrade to version 2.4.58, which fixes the issue.","status":"published","published":"2023-10-23T07:15:11.243Z","modified":"2026-10-26T17:17:58.643129164Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-31610","title":"CVE-2023-43622 affecting package httpd for versions less than 2.4.58-1","description":"An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known \"slow loris\" attack pattern.\nThis has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.\n\nUsers are recommended to upgrade to version 2.4.58, which fixes the issue.","status":"published","published":"2023-10-23T07:15:11Z","modified":"2026-04-21T04:26:27.105984Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-43639","title":"CVE-2023-43622 affecting package mod_http2 1.15.14-2","description":"An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known \"slow loris\" attack pattern.\nThis has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.\n\nUsers are recommended to upgrade to version 2.4.58, which fixes the issue.","status":"published","published":"2023-10-23T07:15:11Z","modified":"2026-04-21T04:31:04.907608Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-44955","title":"CVE-2023-43622 affecting package mod_http2 for versions less than 2.0.29-3","description":"An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known \"slow loris\" attack pattern.\nThis has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.\n\nUsers are recommended to upgrade to version 2.4.58, which fixes the issue.","status":"published","published":"2023-10-23T07:15:11Z","modified":"2026-04-21T04:49:18.190513Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"BELL-CVE-2023-43622","status":"published","published":"2023-10-21T05:58:22.334636Z","modified":"2026-01-26T09:35:30.361633Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"DEBIAN-CVE-2023-43622","description":"An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known \"slow loris\" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.  This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.  Users are recommended to upgrade to version 2.4.58, which fixes the issue.","status":"published","published":"2023-10-23T07:15:11.243Z","modified":"2026-10-26T18:02:34.806843702Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"RHSA-2024:2368","title":"Red Hat Security Advisory: mod_http2 security update","status":"published","published":"2024-09-16T17:50:35Z","modified":"2026-09-21T10:06:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"UBUNTU-CVE-2023-43622","description":"An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known \"slow loris\" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue.","status":"withdrawn","published":"2023-10-23T07:15:00Z","modified":"2026-02-04T02:26:05.390498Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"ALSA-2024:2368","title":"Moderate: mod_http2 security update","description":"The mod_http2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.\n\nSecurity Fix(es):\n\n* httpd: mod_http2: DoS in HTTP/2 with initial window size 0 (CVE-2023-43622)\n* mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487) (CVE-2023-45802)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:07.773476897Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"BIT-apache-2023-43622","title":"Apache HTTP Server: DoS in HTTP/2 with initial windows size 0","description":"An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known \"slow loris\" attack pattern.\nThis has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.\n\nUsers are recommended to upgrade to version 2.4.58, which fixes the issue.","status":"published","published":"2024-03-06T10:50:43.363Z","modified":"2026-09-08T08:45:41.474711943Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"CVE-2023-43622","title":"Apache HTTP Server: DoS in HTTP/2 with initial windows size 0","description":"An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known \"slow loris\" attack pattern.\nThis has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.\n\nUsers are recommended to upgrade to version 2.4.58, which fixes the issue.","status":"published","published":"2023-10-23T06:50:51.555Z","modified":"2026-10-28T02:31:09.01900727Z","cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"DSA-5662-1","title":"apache2 - security update","status":"published","published":"2024-04-16T00:00:00Z","modified":"2026-03-09T02:11:26.616225Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2023-0304","title":"Updated apache packages fix security vulnerabilities","description":"Apache has been updated to version 2.4.58 to fix several security\nissues.\n\nCVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed\nright away on RST (cve.mitre.org)\nWhen a HTTP/2 stream was reset (RST frame) by a client, there was a time\nwindow were the request's memory resources were not reclaimed\nimmediately. Instead, de-allocation was deferred to connection close.\nA client could send new requests and resets, keeping the connection busy\nand open and causing the memory footprint to keep on growing. On\nconnection close, all resources were reclaimed, but the process might\nrun out of memory before that.\nThis was found by the reporter during testing of CVE-2023-44487\n(HTTP/2 Rapid Reset Exploit) with their own test client. During \"normal\"\nHTTP/2 use, the probability to hit this bug is very low. The kept memory\nwould not become noticeable before the connection closes or times out.\nUsers are recommended to upgrade to version 2.4.58, which fixes the\nissue.\nCredits: Will Dormann of Vul Labs\n\nCVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with initial windows\nsize 0 (cve.mitre.org)\nAn attacker, opening a HTTP/2 connection with an initial window size of\n0, was able to block handling of that connection indefinitely in Apache\nHTTP Server. This could be used to exhaust worker resources in the\nserver, similar to the well known \"slow loris\" attack pattern.\nThis has been fixed in version 2.4.58, so that such connection are\nterminated properly after the configured connection timeout.\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.\nUsers are recommended to upgrade to version 2.4.58, which fixes the\nissue.\nCredits: Prof. Sven Dietrich (City University of New York)\n\nCVE-2023-31122: mod_macro buffer over-read\n(cve.mitre.org)\nOut-of-bounds Read vulnerability in mod_macro of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.57.\nCredits: David Shoon (github/davidshoon)\n","status":"published","published":"2023-10-27T21:49:40Z","modified":"2026-04-16T04:41:44.987317118Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13350-1","title":"apache2-2.4.58-1.1 on GA media","description":"These are all security issues fixed in the apache2-2.4.58-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:35:54.067142Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"USN-6506-1","title":"apache2 vulnerabilities","description":"David Shoon discovered that the Apache HTTP Server mod_macro module\nincorrectly handled certain memory operations. A remote attacker could\npossibly use this issue to cause the server to crash, resulting in a denial\nof service. (CVE-2023-31122)\n\nProf. Sven Dietrich, Isa Jafarov, Prof. Heejo Lee, and Choongin Lee\ndiscovered that the Apache HTTP Server incorrectly handled certain HTTP/2\nconnections. A remote attacker could possibly use this issue to cause the\nserver to consume resources, leading to a denial of service. This issue\nonly affected Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-43622)\n\nWill Dormann and David Warren discovered that the Apache HTTP Server\nincorrectly handled memory when handling HTTP/2 connections. A remote\nattacker could possibly use this issue to cause the server to consume\nresources, leading to a denial of service. (CVE-2023-45802)\n","status":"published","published":"2023-11-22T14:55:30Z","modified":"2026-04-27T17:02:17.844992471Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}