CVE-2023-45802

When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.4.58, which fixes the issue.

• CWE-404
• CWE-404

• https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
• https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/05/msg00013.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/Mailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20231027-0011/Third Party Advisory

Published

Oct 23, 2023

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45797A Buffer overflow vulnerability in DreamSecurity MagicLine4N…9.8
• CVE-2023-45798In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerabil…9.8
• CVE-2023-45799In MLSoft TCO!stream versions 8.0.22.1115 and below, a vulne…9.8
• CVE-2023-4580Push notifications stored on disk in private browsing mode w…6.5
• CVE-2023-45800Improper Neutralization of Special Elements used in an SQL C…7.5
• CVE-2023-45801Improper Authentication vulnerability in Nadatel DVR allows …7.5
• CVE-2023-45803urllib3 is a user-friendly HTTP client library for Python. u…4.2
• CVE-2023-45804Rejected reason: User requested a CVE number by mistake
• CVE-2023-45805pdm is a Python package and dependency manager supporting th…7.8
• CVE-2023-45806Discourse is an open source platform for community discussio…5.4
• CVE-2023-45807OpenSearch is a community-driven, open source fork of Elasti…5.4
• CVE-2023-45808iTop is an IT service management platform. When creating or…5.4