CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST
The initial Rapid-Reset fix for modhttp2 was not sufficient to mitigate reset attacks completely; there is still a potential resource leak. If reset requests are sent on a connection below the rate limit imposed by nghttp2, memory is still consumed per RST and persists until the connection is broken. This "slow drip" of <1000 RST per second is sufficient to disable a single connection.
Other sources
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.4.58, which fixes the issue.
— Ubuntu
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-45802?
The severity of CVE-2023-45802 is medium with a severity value of 5.9.
What is the affected software for CVE-2023-45802?
The affected software for CVE-2023-45802 is Apache HTTP server version up to exclusive 2.4.58 and Fedora version 38.
How can I fix CVE-2023-45802?
To fix CVE-2023-45802, update your Apache HTTP server to a version higher than 2.4.58 or apply relevant security patches for Fedora version 38.
What is the Common Weakness Enumeration (CWE) for CVE-2023-45802?
The Common Weakness Enumeration (CWE) for CVE-2023-45802 is CWE-400.
Where can I find more information about CVE-2023-45802?
More information about CVE-2023-45802 can be found at the following references: [link1](https://httpd.apache.org/security/vulnerabilities_24.html), [link2](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/), [link3](https://security.netapp.com/advisory/ntap-20231027-0011/).