CVE-2023-45802

CWE-404CWE-400 — Uncontrolled Resource ConsumptionCWE-770 — Allocation without Limits10 documents9 sources
Severity
5.9MEDIUM
EPSS
1.7%
top 17.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Apache Http ServerApache Software Foundation Apache Http ServerDebian Debian Linux+1 more
Timeline
PublishedOct 23
Latest updateNov 22

Description

When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-20…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6

Affected Packages4 packages

▶NVDapache/http_server2.4.17 — 2.4.58
▶Alpineapache2< 2.4.58-r0+8
▶Debianapache2< 2.4.59-1~deb11u1+3

Also affects: Debian Linux 10.0, Fedora 37, 38, 39

🔴Vulnerability Details

4
CVEList
Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST↗2023-10-23
▶
OSV
CVE-2023-45802: When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately↗2023-10-23
▶
GHSA
GHSA-m4mp-v249-x3mh: When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately↗2023-10-23
▶
OSV
CVE-2023-45802: When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately↗2023-10-23
▶

📋Vendor Advisories

5
Ubuntu
Apache HTTP Server vulnerabilities↗2023-11-22
▶
Red Hat
mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487)↗2023-10-19
▶
Microsoft
Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST↗2023-10-10
▶
Debian
CVE-2023-45802: apache2 - When a HTTP/2 stream was reset (RST frame) by a client, there was a time window ...↗2023
▶
Apache
Apache httpd: CVE-2023-45802↗
▶
CVE-2023-45802 (MEDIUM CVSS 5.9) | When a HTTP/2 stream was reset (RST | cvebase.io