UpHeron
All vulnerabilities

Servers and applications

CVE-2018-11763

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.

Severity
Medium 5.9
Published
25 Sept 2018
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache HTTP ServerServers and applications · cpe:a:apache:http_server
  • From 2.4.17 up to 2.4.34

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-11763
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-11763