Read the docs
TI-2018-12288 Aliases CVE-2018-17189GHSA-xcwr-pcwv-7gm8

Uncontrolled resource consumption in Apache HTTP Server

Priority MEDIUM 42CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.

Why it matters now

EPSS 0.19404 97th percentileScored 2026-11-07
Fix Fixed Red Hat: 5 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache HTTP Server2.4.17 to 2.4.37—No fix listedCNA
  • Apache HTTP Server VendorApache Affected 2.4.17 to 2.4.37 Fixed in — No fix listed CNA

CPE configurations NVD · 35

CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:2.4.17:*:*:*:*:*:*:*2.4.17VulnerableApache
cpe:2.3:a:apache:http_server:2.4.18:*:*:*:*:*:*:*2.4.18VulnerableApache
cpe:2.3:a:apache:http_server:2.4.20:*:*:*:*:*:*:*2.4.20VulnerableApache
cpe:2.3:a:apache:http_server:2.4.23:*:*:*:*:*:*:*2.4.23VulnerableApache
cpe:2.3:a:apache:http_server:2.4.25:*:*:*:*:*:*:*2.4.25VulnerableApache
cpe:2.3:a:apache:http_server:2.4.26:*:*:*:*:*:*:*2.4.26VulnerableApache
cpe:2.3:a:apache:http_server:2.4.27:*:*:*:*:*:*:*2.4.27VulnerableApache
cpe:2.3:a:apache:http_server:2.4.28:*:*:*:*:*:*:*2.4.28VulnerableApache
cpe:2.3:a:apache:http_server:2.4.29:*:*:*:*:*:*:*2.4.29VulnerableApache
cpe:2.3:a:apache:http_server:2.4.30:*:*:*:*:*:*:*2.4.30VulnerableApache
  • cpe:2.3:a:apache:http_server:2.4.17:*:*:*:*:*:*:* Versions 2.4.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.4.18:*:*:*:*:*:*:* Versions 2.4.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.4.20:*:*:*:*:*:*:* Versions 2.4.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.4.23:*:*:*:*:*:*:* Versions 2.4.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.4.25:*:*:*:*:*:*:* Versions 2.4.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.4.26:*:*:*:*:*:*:* Versions 2.4.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.4.27:*:*:*:*:*:*:* Versions 2.4.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.4.28:*:*:*:*:*:*:* Versions 2.4.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.4.29:*:*:*:*:*:*:* Versions 2.4.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.4.30:*:*:*:*:*:*:* Versions 2.4.30 Vulnerable ·Apache
Show 25 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:2.4.33:*:*:*:*:*:*:*2.4.33VulnerableApache
cpe:2.3:a:apache:http_server:2.4.34:*:*:*:*:*:*:*2.4.34VulnerableApache
cpe:2.3:a:apache:http_server:2.4.35:*:*:*:*:*:*:*2.4.35VulnerableApache
cpe:2.3:a:apache:http_server:2.4.37:*:*:*:*:*:*:*2.4.37VulnerableApache
cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*28VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*29VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*12.3.3VulnerableOracle
cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableOracle
cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*4.2.1VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*17.1VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*17.2VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*17.3VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.0:*:*:*:*:*:*:*7.0VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*7.1VulnerableOracle
cpe:2.3:a:oracle:sun_zfs_storage_appliance_kit:8.8.6:*:*:*:*:*:*:*8.8.6VulnerableOracle
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*14.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*18.10VulnerableCanonical
cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
  • cpe:2.3:a:apache:http_server:2.4.33:*:*:*:*:*:*:* Versions 2.4.33 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.4.34:*:*:*:*:*:*:* Versions 2.4.34 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.4.35:*:*:*:*:*:*:* Versions 2.4.35 Vulnerable ·Apache
  • cpe:2.3:a:apache:http_server:2.4.37:*:*:*:*:*:*:* Versions 2.4.37 Vulnerable ·Apache
  • cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:* Versions 28 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* Versions 12.3.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:* Versions 17.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:* Versions 17.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:* Versions 17.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:sun_zfs_storage_appliance_kit:8.8.6:*:*:*:*:*:*:* Versions 8.8.6 Vulnerable ·Oracle
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* Versions 18.10 Vulnerable ·Canonical
  • cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat

Remediation

Red Hat 5 advisories

  • RHSA-2020:4751 Released 2020-11-04 · Red Hat rating Moderate
    httpd:2.4 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) httpd-2.4.37-30.module+el8.3.0+7001+0766b9e7.aarch64::httpd:2.4, httpd-2.4.37-30.module+el8.3.0+7001+0766b9e7.ppc64le::httpd:2.4, httpd-2.4.37-30.module+el8.3.0+7001+0766b9e7.s390x::httpd:2.4 +38
  • RHSA-2019:4126 Released 2019-12-10 · Red Hat rating Moderate
    httpd24-httpd security, bug fix, and enhancement update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) httpd24-1.1-19.el6, httpd24-build-1.1-19.el6, httpd24-httpd-2.4.34-15.el6 +12
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) httpd24-1.1-19.el7, httpd24-httpd-2.4.34-15.el7, httpd24-httpd-devel-2.4.34-15.el7 +12
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) httpd24-1.1-19.el7, httpd24-httpd-2.4.34-15.el7, httpd24-httpd-devel-2.4.34-15.el7 +12
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) httpd24-1.1-19.el7, httpd24-httpd-2.4.34-15.el7, httpd24-httpd-devel-2.4.34-15.el7 +12
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) httpd24-1.1-19.el7, httpd24-httpd-2.4.34-15.el7, httpd24-httpd-devel-2.4.34-15.el7 +12
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) httpd24-1.1-19.el6, httpd24-build-1.1-19.el6, httpd24-httpd-2.4.34-15.el6 +12
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) httpd24-1.1-19.el7, httpd24-httpd-2.4.34-15.el7, httpd24-httpd-devel-2.4.34-15.el7 +12
  • RHSA-2019:3932 Released 2019-11-20 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6
    • Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-apr-1.6.3-63.jbcs.el6, jbcs-httpd24-apr-devel-1.6.3-63.jbcs.el6, jbcs-httpd24-apr-util-1.6.1-48.jbcs.el6 +37
Show 2 more Red Hat advisories
  • RHSA-2019:3933 Released 2019-11-20 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-1.6.3-63.jbcs.el7, jbcs-httpd24-apr-devel-1.6.3-63.jbcs.el7, jbcs-httpd24-apr-util-1.6.1-48.jbcs.el7 +37
  • RHSA-2019:3935 Released 2019-11-20 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release
    • Red Hat JBoss Core Services

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4751
Red Hat JBoss Core ServicesFixed RHSA-2019:3935
Red Hat JBoss Core Services on RHEL 6 ServerFixed RHSA-2019:3932
Red Hat JBoss Core Services on RHEL 7 ServerFixed RHSA-2019:3933
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2019:4126
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:4126
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)Fixed RHSA-2019:4126
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2019:4126
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2019:4126
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2019:4126
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:4126
Not affected: 9 products
  • CloudForms Management Engine 5
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat JBoss Enterprise Application Platform 5
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Web Server 2
  • Red Hat JBoss Web Server 3
  • Red Hat Virtualization 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-17189
  2. 2026-10-03 Alias added: GHSA-xcwr-pcwv-7gm8

References

Advisory 17

Other 12

  • TI-2021-18535 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-18417 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-25716 Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. KEVCVSS 3.1CRITICAL 9.1
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
  • TI-2019-00184 Use after free in Apache HTTP Server KEVCVSS 3.1HIGH 7.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
See all 349 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences