CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/apache2to a version that resolves this vulnerability.Fixed in 2.4.55-1ubuntu2.1 - Upgrade
Upgrade
ubuntu/apache2to a version that resolves this vulnerability.Fixed in 2.4.57-2ubuntu2.1 - Upgrade
Upgrade
ubuntu/apache2to a version that resolves this vulnerability.Fixed in 2.4.58-1 - Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.38-3+deb10u8Fixed in 2.4.38-3+deb10u10Fixed in 2.4.59-1~deb11u1Fixed in 2.4.59-1~deb12u1Fixed in 2.4.58-1Fixed in 2.4.59-1 - Upgrade
Upgrade
redhat/mod_http2to a version that resolves this vulnerability.Fixed in 2.0.23 - Upgrade
Upgrade
Apache HTTP Serverto a version that resolves this vulnerability.Fixed in 2.4.58 - Compensating control
If upgrading to 2.4.58 is not immediately possible, mitigate potential DoS from HTTP/2 connections by restricting or filtering external access to Apache at the network layer (e.g., via firewall/ACL) to limit attacker ability to exhaust worker resources.
Event History
Frequently Asked Questions
What is CVE-2023-43622?
CVE-2023-43622 is a vulnerability in the Apache HTTP Server that allows an attacker to block the handling of a connection indefinitely by opening an HTTP/2 connection with an initial window size of 0.
What is the impact of CVE-2023-43622?
The vulnerability in CVE-2023-43622 can be used to exhaust worker resources in the server, similar to the 'slow loris' attack pattern.
Which versions of Apache HTTP Server are affected by CVE-2023-43622?
Versions of Apache HTTP Server from 2.4.55 to 2.4.58 are affected by CVE-2023-43622.
How can I fix CVE-2023-43622?
The vulnerability has been fixed in version 2.4.59 of Apache HTTP Server. It is recommended to upgrade to this version or a later version.
Where can I find more information about CVE-2023-43622?
You can find more information about CVE-2023-43622 on the Apache HTTP Server website and the NetApp security advisory.