Description
HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Apache Software Foundation Apache HTTP Server
Default version status: unaffected
2.4.17 to ≤ 2.4.58affected
References
- https://httpd.apache.org/security/vulnerabilities_24.html ↗
- https://www.openwall.com/lists/oss-security/2024/04/03/16 ↗
- http://www.openwall.com/lists/oss-security/2024/04/04/4 ↗
- https://support.apple.com/kb/HT214119 ↗
- http://seclists.org/fulldisclosure/2024/Jul/18 ↗
- https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIUBKSCJGPJ6M2U63V6BKFDF725ODLG7/ ↗
- https://security.netapp.com/advisory/ntap-20240415-0013/ ↗
- https://www.kb.cert.org/vuls/id/421644 ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FO73U3SLBYFGIW2YKXOK7RI4D6DJSZ2B/ ↗