Red Hat Security Advisory

RHSA-2024:2368

mod_http2 security update

Released 2024-04-30 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) mod_http2-2.0.26-1.el9

Fixes 2 records

TI-2023-23350 CVE-2023-43622 · GHSA-w2qc-22jv-44g8

Apache HTTP Server: DoS in HTTP/2 with initial windows size 0

HIGH 76

An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.68818 Published 2023-10-23 Fixed CWE-400

TI-2023-24564 CVE-2023-45802 · GHSA-m4mp-v249-x3mh

Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST

LOW 32

When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.03168 Published 2023-10-23 Partial fix CWE-404