CVE-2018-11763: Medium severity Apache HTTP Server vulnerability
In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-11763?
The severity of CVE-2018-11763 is medium (5.9).
How does CVE-2018-11763 affect Apache HTTP Server?
CVE-2018-11763 affects Apache HTTP Server versions 2.4.17 to 2.4.34.
What is the possible mitigation for CVE-2018-11763?
A possible mitigation for CVE-2018-11763 is to not enable the h2 protocol.
Which software versions are affected by CVE-2018-11763?
CVE-2018-11763 affects Apache HTTP Server versions 2.4.17 to 2.4.34, mod_http2 version up to 1.11.0, and some versions of Redhat Enterprise Linux, Canonical Ubuntu Linux, Oracle Enterprise Manager Ops Center, Oracle Hospitality Guest Access, Oracle Instantis Enterprisetrack, Oracle Retail Xstore Point of Service, Oracle Secure Global Desktop, and Netapp Storage Automation Store.
How do I fix CVE-2018-11763?
To fix CVE-2018-11763, update Apache HTTP Server to version 2.4.35 or higher.