CVE-2023-43622
published 2023-10-23CVE-2023-43622: An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server…
PriorityP261high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
70.59%
99.3th percentile
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern.
This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.
This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.
Users are recommended to upgrade to version 2.4.58, which fixes the issue.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 2.4.55 < 2.4.58 | 2.4.58 |
| apache_software_foundation | apache_http_server | 2.4.55 – 2.4.57 | — |
| debian | apache2 | < apache2 2.4.59-1~deb12u1 (bookworm) | apache2 2.4.59-1~deb12u1 (bookworm) |
| msrc | azl3_mod_http2_2.0.29-3_on_azure_linux_3.0 | — | — |
| msrc | cbl2_httpd_2.4.58-1_on_cbl_mariner_2.0 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP/2 connections established with an initial SETTINGS frame advertising a flow-control window size of 0, which is the attack primitive for this DoS ↗
- →Monitor for worker/thread exhaustion on Apache httpd servers running mod_http2, consistent with a slow-loris-style resource exhaustion pattern via HTTP/2 ↗
- →This vulnerability is only exploitable when mod_http2 is loaded and an HTTP/2 server is configured; scope detection efforts to servers with mod_http2 active ↗
- ·Vulnerable version range is Apache HTTP Server 2.4.55 through 2.4.57 only; 2.4.58 and later are not affected ↗
- ·The mod_http2 module is enabled by default on RHEL 8 and 9 via the mod_http2 package, but no HTTP/2 server is configured by default — both conditions must be true for exposure ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Hitachi Energy Service Suite
cisa_ics·2025-05-13·CVSS 9.8
[CRITICAL] Hitachi Energy Service Suite
ICS Advisory
##
Hitachi Energy Service Suite
Release DateMay 13, 2025
Alert CodeICSA-25-133-01
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 9.3
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Hitachi Energy
- Equipment: Service Suite
- Vulnerabilities: Use of Less Trusted Source, Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), Integer Overflow or Wraparound, Out-of-bounds Write, Allocation of Resources Without Limits or Throttling, Exposure of Sensitive Information to an Unauthorized Actor, Memory Allocation with Excessive Size Value, Out-of-bounds Read, Uncontrolled Resource Consumption, Improper Resource Shutdown or Re
CISA ICS
Siemens SINEC NMS
cisa_ics·2024-08-15·CVSS 7.0
[HIGH] Siemens SINEC NMS
ICS Advisory
##
Siemens SINEC NMS
Release DateAugust 15, 2024
Alert CodeICSA-24-228-06
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 9.4
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC NMS
- Vulnerabilities: Use After Free, Improper Input Validation, Deserialization of Untrusted Data, Improper Restriction of Operations
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2023-11-22·CVSS 7.5
CVE-2023-45802 [HIGH] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
David Shoon discovered that the Apache HTTP Server mod_macro module
incorrectly handled certain memory operations. A remote attacker could
possibly use this issue to cause the server to crash, resulting in a denial
of service. (CVE-2023-31122)
Prof. Sven Dietrich, Isa Jafarov, Prof. Heejo Lee, and Choongin Lee
discovered that the Apache HTTP Server incorrectly handled certain HTTP/2
connections. A remote attacker could possibly use this issue to cause the
server to consume resources, leading to a denial of service. This issue
only affected Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-43622)
Will Dormann and David Warren discovered that the Apache HTTP Server
incorrectly handled mem
Red Hat
httpd: mod_http2: DoS in HTTP/2 with initial window size 0
vendor_redhat·2023-10-10·CVSS 7.5
CVE-2023-43622 [HIGH] CWE-400 httpd: mod_http2: DoS in HTTP/2 with initial window size 0
httpd: mod_http2: DoS in HTTP/2 with initial window size 0
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern.
This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.
This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.
Users are recommended to upgrade to version 2.4.58, which fixes the issue.
A flaw was found in the mod_http2 module of httpd. This flaw allows an attacker opening an HTTP/2 connection with an initial window size of 0 to block handling of that connection indefinitely. Th
Microsoft
Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
vendor_msrc·2023-10-10·CVSS 7.5
CVE-2023-43622 [HIGH] CWE-400 Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
apache: apache
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https
Debian
CVE-2023-43622: apache2 - An attacker, opening a HTTP/2 connection with an initial window size of 0, was a...
vendor_debian·2023·CVSS 7.5
CVE-2023-43622 [HIGH] CVE-2023-43622: apache2 - An attacker, opening a HTTP/2 connection with an initial window size of 0, was a...
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue.
Scope: local
bookworm: resolved (fixed in 2.4.59-1~deb12u1)
bullseye: resolved (fixed in 2.4.59-1~deb11u1)
forky: resolved (fixed in 2.4.58-1)
sid: resolved (fixed in 2.4.58-1)
trixie: resolved (fixed in 2.4.58-1)
OSV
apache2 vulnerabilities
osv·2023-11-22·CVSS 7.5
CVE-2023-31122 [HIGH] apache2 vulnerabilities
apache2 vulnerabilities
David Shoon discovered that the Apache HTTP Server mod_macro module
incorrectly handled certain memory operations. A remote attacker could
possibly use this issue to cause the server to crash, resulting in a denial
of service. (CVE-2023-31122)
Prof. Sven Dietrich, Isa Jafarov, Prof. Heejo Lee, and Choongin Lee
discovered that the Apache HTTP Server incorrectly handled certain HTTP/2
connections. A remote attacker could possibly use this issue to cause the
server to consume resources, leading to a denial of service. This issue
only affected Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-43622)
Will Dormann and David Warren discovered that the Apache HTTP Server
incorrectly handled memory when handling HTTP/2 connections. A remote
attacker could possibly use this issue
OSV
CVE-2023-43622: An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP S
osv·2023-10-23·CVSS 7.5
CVE-2023-43622 [HIGH] CVE-2023-43622: An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP S
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue.
GHSA
GHSA-w2qc-22jv-44g8: An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP S
ghsa_unreviewed·2023-10-23
CVE-2023-43622 [HIGH] CWE-400 GHSA-w2qc-22jv-44g8: An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP S
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern.
This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.
This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.
Users are recommended to upgrade to version 2.4.58, which fixes the issue.
OSV
CVE-2023-43622: An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP S
osv·2023-10-23·CVSS 7.5
CVE-2023-43622 [HIGH] CVE-2023-43622: An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP S
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern.
This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.
This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.
Users are recommended to upgrade to version 2.4.58, which fixes the issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-10-23
Published