CVE-2018-17189

First published: Tue Jan 22 2019(Updated: )

A flaw was found in HTTP/2 (mod_http2) connections in Apache HTTP Server httpd 2.4.17 to 2.4.37. A DoS can be triggered by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. References: <a href="https://seclists.org/oss-sec/2019/q1/80">https://seclists.org/oss-sec/2019/q1/80</a> <a href="https://httpd.apache.org/security/vulnerabilities_24.html">https://httpd.apache.org/security/vulnerabilities_24.html</a>

Credit: security@apache.org security@apache.org

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-cve
• collector/debian-bugs
• alias/CVE-2018-17189
• agent/first-publish-date
• collector/launchpad-cve
• source/Launchpad
• agent/type
• agent/author
• collector/redhat-bugzilla
• source/Red Hat
• agent/software-canonical-lookup
• agent/weakness
• agent/remedy
• agent/severity
• agent/description
• agent/references
• collector/nvd-cve
• source/NVD
• agent/software-canonical-lookup-request
• collector/nvd-index
• collector/mitre-cve
• source/MITRE
• agent/last-modified-date
• agent/event
• agent/tags
• collector/security-tracker-debian
• source/Debian
• agent/softwarecombine
• collector/usn-cve
• source/Ubuntu
• package-manager/redhat
• package-manager/debian
• vendor/apache
• canonical/apache http server
• version/apache http server/2.4.17
• version/apache http server/2.4.18
• version/apache http server/2.4.20
• version/apache http server/2.4.23
• version/apache http server/2.4.25
• version/apache http server/2.4.26
• version/apache http server/2.4.27
• version/apache http server/2.4.28
• version/apache http server/2.4.29
• version/apache http server/2.4.30
• version/apache http server/2.4.33
• version/apache http server/2.4.34
• version/apache http server/2.4.35
• version/apache http server/2.4.37
• vendor/netapp
• canonical/netapp santricity cloud connector
• canonical/netapp storage automation store
• vendor/fedoraproject
• canonical/fedoraproject fedora
• version/fedoraproject fedora/28
• version/fedoraproject fedora/29
• vendor/debian
• canonical/debian debian linux
• version/debian debian linux/9.0
• vendor/oracle
• canonical/oracle enterprise manager ops center
• version/oracle enterprise manager ops center/12.3.3
• canonical/oracle hospitality guest access
• version/oracle hospitality guest access/4.2.0
• version/oracle hospitality guest access/4.2.1
• canonical/oracle instantis enterprisetrack
• version/oracle instantis enterprisetrack/17.1
• version/oracle instantis enterprisetrack/17.2
• version/oracle instantis enterprisetrack/17.3
• canonical/oracle retail xstore point of service
• version/oracle retail xstore point of service/7.0
• version/oracle retail xstore point of service/7.1
• canonical/oracle sun zfs storage appliance kit
• version/oracle sun zfs storage appliance kit/8.8.6
• vendor/canonical
• canonical/canonical ubuntu linux
• version/canonical ubuntu linux/14.04
• version/canonical ubuntu linux/16.04
• version/canonical ubuntu linux/18.04
• version/canonical ubuntu linux/18.10
• vendor/redhat
• canonical/redhat jboss core services
• version/redhat jboss core services/1.0
• canonical/redhat enterprise linux
• version/redhat enterprise linux/6.0
• version/redhat enterprise linux/7.0