CVE-2023-43622
Last modified
CVE-2023-43622 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue.. EPSS estimates a 70.59% chance of exploitation in the next 30 days.
Description
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Http Server | >= 2.4.55, < 2.4.58 |
References
- https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
- https://security.netapp.com/advisory/ntap-20231027-0011/Third Party Advisory
- https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
- https://security.netapp.com/advisory/ntap-20231027-0011/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-43622?
How severe is CVE-2023-43622?
How do I fix CVE-2023-43622?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-43617An issue was discovered in Croc through 9.6.5. When a custom…5.3
- CVE-2023-43618An issue was discovered in Croc through 9.6.5. The protocol …5.3
- CVE-2023-43619An issue was discovered in Croc through 9.6.5. A sender may …7.8
- CVE-2023-4362Heap buffer overflow in Mojom IDL in Google Chrome prior to …8.8
- CVE-2023-43620An issue was discovered in Croc through 9.6.5. A sender may …7.8
- CVE-2023-43621An issue was discovered in Croc through 9.6.5. The shared se…4.7
- CVE-2023-43623A vulnerability has been identified in Mendix Forgot Passwor…5.3
- CVE-2023-43624CX-Designer Ver.3.740 and earlier (included in CX-One CXONE-…5.5
- CVE-2023-43625A vulnerability has been identified in Simcenter Amesim (All…9.8
- CVE-2023-43626Improper access control in UEFI firmware for some Intel(R) P…8.7
- CVE-2023-43627Path traversal vulnerability in ACERA 1320 firmware ver.01.2…5.7
- CVE-2023-43628An integer underflow vulnerability exists in the NTRIP Strea…7.5
Are you affected by CVE-2023-43622?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST