Vulnerability · Published Oct 23, 2023 · Assigned by apache
CVE-2023-43622Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
High 7.5
In plain English
A high-severity uncontrolled resource consumption in Apache HTTP Server from Apache Software Foundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 68.8% (higher than 99.4% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | mod_http2 | 2.0.26-1.el9 | ALSA-2024:2368 |
| Alpine:v3.20 | apache2 | 2.4.58-r0 | ALPINE-CVE-2023-43622 |
| Alpine:v3.21 | apache2 | 2.4.58-r0 | ALPINE-CVE-2023-43622 |
| Alpine:v3.22 | apache2 | 2.4.58-r0 | ALPINE-CVE-2023-43622 |
| Alpine:v3.23 | apache2 | 2.4.58-r0 | ALPINE-CVE-2023-43622 |
| Alpine:v3.24 | apache2 | 2.4.58-r0 | ALPINE-CVE-2023-43622 |
| Debian:12 | apache2 | 2.4.59-1~deb12u1 | DEBIAN-CVE-2023-43622 |
| Debian:12 | apache2 | 2.4.59-1~deb12u1 | DSA-5662-1 |
| Debian:13 | apache2 | 2.4.58-1 | DEBIAN-CVE-2023-43622 |
| Debian:14 | apache2 | 2.4.58-1 | DEBIAN-CVE-2023-43622 |
| Ubuntu:22.04:LTS | apache2 | 2.4.52-1ubuntu4.7 | USN-6506-1 |
| Ubuntu:22.04:LTS | apache2 | 2.4.52-1ubuntu4.6 | UBUNTU-CVE-2023-43622 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache HTTP Server | 2.4.55 – through 2.4.57 |
Weakness: CWE-400