Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST
Priority LOW 32CWE-404Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 6 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-404.
Summary
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.4.58, which fixes the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03168 88th percentileScored 2026-11-07
Fix Partial Red Hat: 5 advisoriesRed Hat: 6 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache HTTP Server | 2.4.17 – 2.4.57 | — | No fix listed | CNA |
- Apache HTTP Server VendorApache Affected 2.4.17 – 2.4.57 Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | 2.4.17 to before 2.4.58 | Vulnerable | Apache |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
- cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* Versions 2.4.17 to before 2.4.58 Vulnerable ·Apache
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Remediation
Red Hat 5 advisories
- RHSA-2024:3121 Released 2024-05-22 · Red Hat rating Moderatehttpd:2.4 security update
- Red Hat Enterprise Linux AppStream (v. 8) httpd-2.4.37-64.module+el8.10.0+21332+dfb1b40e.aarch64::httpd:2.4, httpd-2.4.37-64.module+el8.10.0+21332+dfb1b40e.ppc64le::httpd:2.4, httpd-2.4.37-64.module+el8.10.0+21332+dfb1b40e.s390x::httpd:2.4 +38
- RHSA-2024:2891 Released 2024-05-16 · Red Hat rating Moderatehttpd:2.4 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) httpd-2.4.37-56.module+el8.8.0+19808+379766d6.7.aarch64::httpd:2.4, httpd-2.4.37-56.module+el8.8.0+19808+379766d6.7.ppc64le::httpd:2.4, httpd-2.4.37-56.module+el8.8.0+19808+379766d6.7.s390x::httpd:2.4 +38
- RHSA-2024:2368 Released 2024-04-30 · Red Hat rating Moderatemod_http2 security update
- Red Hat Enterprise Linux AppStream (v. 9) mod_http2-2.0.26-1.el9
Show 2 more Red Hat advisories
- RHSA-2023:7626 Released 2023-12-07 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 security update
- Red Hat JBoss Core Services
- RHSA-2023:7625 Released 2023-12-07 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 security update
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl-8.4.0-2.el7jbcs, jbcs-httpd24-libcurl-8.4.0-2.el7jbcs, jbcs-httpd24-libcurl-devel-8.4.0-2.el7jbcs +8
- Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl-8.4.0-2.el8jbcs, jbcs-httpd24-libcurl-8.4.0-2.el8jbcs, jbcs-httpd24-libcurl-devel-8.4.0-2.el8jbcs +8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:3121 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:2368 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:2891 |
| Red Hat JBoss Core Services | Fixed | RHSA-2023:7626 |
| Red Hat JBoss Core Services on RHEL 7 Server | Fixed | RHSA-2023:7625 |
| Red Hat JBoss Core Services on RHEL 8 | Fixed | RHSA-2023:7625 |
Not affected: 4 products
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 9
- Red Hat JBoss Core Services on RHEL 7 Server
- Red Hat JBoss Core Services on RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2023-45802
- 2026-10-03 Alias added: GHSA-m4mp-v249-x3mh
- 2026-10-09 Fix available: RHSA-2023:7626 · Red Hat
- 2026-10-31 Fix available: Red Hat JBoss Core Services · Red Hat
References
Advisory 6
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/
- https://security.netapp.com/advisory/ntap-20231027-0011/
More Apache Http Server vulnerabilities
- TI-2021-18535 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) KEVCVSS 3.1CRITICAL 9.8
- TI-2021-18417 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 KEVCVSS 3.1CRITICAL 9.8
- TI-2024-25716 Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. KEVCVSS 3.1CRITICAL 9.1
- TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
- TI-2019-00184 Use after free in Apache HTTP Server KEVCVSS 3.1HIGH 7.8
- TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-45802 · CVE Program
- CVE-2023-45802 · NVD
- FIRST EPSS
- GHSA-m4mp-v249-x3mh · GitHub Advisory Database · CC BY 4.0
- CVE-2023-45802 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences