CVE-2023-45802 — Improper Resource Shutdown or Release

Vendor	Product	Version range	Fixed in
apache	http_server	>= 2.4.17 < 2.4.58	2.4.58
apache	httpd	—	—
debian	apache2	< apache2 2.4.59-1~deb12u1 (bookworm)	apache2 2.4.59-1~deb12u1 (bookworm)
debian	debian_linux	—	—
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
msrc	azl3_mod_http2_2.0.29-3_on_azure_linux_3.0	—	—
msrc	cbl2_httpd_2.4.58-1_on_cbl_mariner_2.0	—	—
ubuntu	apache2	—	—

Ubuntu

Apache HTTP Server regression

vendor_ubuntu·2026-05-29·CVSS 7.3

CVE-2023-38709 [HIGH] Apache HTTP Server regression Title: Apache HTTP Server regression Summary: USN-8338-1 introduced a regression in Apache HTTP Server USN-8338-1 fixed vulnerabilities in Apache HTTP Server. The update introduced a regression that prevented mod_http2 from loading on Ubuntu 18.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that Apache HTTP Server incorrectly handled certain response headers. An attacker could possibly use this issue to perform HTTP response splitting attacks. This issue only affected Ubuntu 14.04 LTS. (CVE-2023-38709) Will Dormann and David Warren discovered that Apache HTTP Server's HTTP/2 implementation did not properly reclaim memory when streams were reset by clients. A remote attacker could possibly use this issue to cause

Ubuntu

Apache HTTP Server vulnerabilities

vendor_ubuntu·2026-05-28·CVSS 7.3

CVE-2023-38709 [HIGH] Apache HTTP Server vulnerabilities Title: Apache HTTP Server vulnerabilities Summary: Several security issues were fixed in Apache HTTP Server. It was discovered that Apache HTTP Server incorrectly handled certain response headers. An attacker could possibly use this issue to perform HTTP response splitting attacks. This issue only affected Ubuntu 14.04 LTS. (CVE-2023-38709) Will Dormann and David Warren discovered that Apache HTTP Server's HTTP/2 implementation did not properly reclaim memory when streams were reset by clients. A remote attacker could possibly use this issue to cause Apache HTTP Server to consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2023-45802) Keran Mu and Jianjun Chen discovered that Apache HTTP Server incorrectly handled certain response headers.

CISA ICS

Hitachi Energy Service Suite

cisa_ics·2025-05-13·CVSS 9.8

[CRITICAL] Hitachi Energy Service Suite ICS Advisory ## Hitachi Energy Service Suite Release DateMay 13, 2025 Alert CodeICSA-25-133-01 Related topics: Industrial Control System Vulnerabilities, Industrial Control Systems View CSAF ## 1. EXECUTIVE SUMMARY - CVSS v4 9.3 - ATTENTION: Exploitable remotely/low attack complexity - Vendor: Hitachi Energy - Equipment: Service Suite - Vulnerabilities: Use of Less Trusted Source, Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), Integer Overflow or Wraparound, Out-of-bounds Write, Allocation of Resources Without Limits or Throttling, Exposure of Sensitive Information to an Unauthorized Actor, Memory Allocation with Excessive Size Value, Out-of-bounds Read, Uncontrolled Resource Consumption, Improper Resource Shutdown or Re

CISA ICS

Siemens SINEC NMS

cisa_ics·2024-08-15·CVSS 7.0

[HIGH] Siemens SINEC NMS ICS Advisory ## Siemens SINEC NMS Release DateAugust 15, 2024 Alert CodeICSA-24-228-06 Related topics: Industrial Control System Vulnerabilities, Industrial Control Systems As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF ## 1. EXECUTIVE SUMMARY - CVSS v4 9.4 - ATTENTION: Exploitable remotely/low attack complexity - Vendor: Siemens - Equipment: SINEC NMS - Vulnerabilities: Use After Free, Improper Input Validation, Deserialization of Untrusted Data, Improper Restriction of Operations

Ubuntu

Apache HTTP Server vulnerabilities

vendor_ubuntu·2023-11-22·CVSS 7.5

CVE-2023-45802 [HIGH] Apache HTTP Server vulnerabilities Title: Apache HTTP Server vulnerabilities Summary: Several security issues were fixed in Apache HTTP Server. David Shoon discovered that the Apache HTTP Server mod_macro module incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. (CVE-2023-31122) Prof. Sven Dietrich, Isa Jafarov, Prof. Heejo Lee, and Choongin Lee discovered that the Apache HTTP Server incorrectly handled certain HTTP/2 connections. A remote attacker could possibly use this issue to cause the server to consume resources, leading to a denial of service. This issue only affected Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-43622) Will Dormann and David Warren discovered that the Apache HTTP Server incorrectly handled mem

Red Hat

mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487)

vendor_redhat·2023-10-19·CVSS 7.5

CVE-2023-45802 [HIGH] CWE-400 mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487) mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487) When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out

Microsoft

Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST

vendor_msrc·2023-10-10·CVSS 5.9

CVE-2023-45802 [MEDIUM] CWE-404 Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this. Mariner: Mariner apache: apache Customer Action Required: Yes Remediation: CBL-Mariner Releases Refer

Debian

CVE-2023-45802: apache2 - When a HTTP/2 stream was reset (RST frame) by a client, there was a time window ...

vendor_debian·2023·CVSS 7.5

CVE-2023-45802 [HIGH] CVE-2023-45802: apache2 - When a HTTP/2 stream was reset (RST frame) by a client, there was a time window ... When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.4.58, which fixes the issue.

Apache

Apache httpd: CVE-2023-45802

vendor_apache·CVSS 7.5

CVE-2023-45802 Apache httpd: CVE-2023-45802 Apache httpd: CVE-2023-45802 When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.

OSV

apache2 vulnerabilities

osv·2023-11-22·CVSS 7.5

CVE-2023-31122 [HIGH] apache2 vulnerabilities apache2 vulnerabilities David Shoon discovered that the Apache HTTP Server mod_macro module incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. (CVE-2023-31122) Prof. Sven Dietrich, Isa Jafarov, Prof. Heejo Lee, and Choongin Lee discovered that the Apache HTTP Server incorrectly handled certain HTTP/2 connections. A remote attacker could possibly use this issue to cause the server to consume resources, leading to a denial of service. This issue only affected Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-43622) Will Dormann and David Warren discovered that the Apache HTTP Server incorrectly handled memory when handling HTTP/2 connections. A remote attacker could possibly use this issue

OSV

CVE-2023-45802: When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately

osv·2023-10-23·CVSS 7.5

CVE-2023-45802 [HIGH] CVE-2023-45802: When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.4.58, which fixes the issue

GHSA

GHSA-m4mp-v249-x3mh: When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately

ghsa_unreviewed·2023-10-23·CVSS 7.5

CVE-2023-45802 [HIGH] CWE-400 GHSA-m4mp-v249-x3mh: When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.4.58, which fixes the issue

OSV

CVE-2023-45802: When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately

osv·2023-10-23·CVSS 7.5

CVE-2023-45802 [HIGH] CVE-2023-45802: When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.4.58, which fixes the issue.

CVE-2023-45802: When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead…

Affected

CVSS provenance