UpHeron
All vulnerabilities

Servers and applications

CVE-2023-43622

An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection…

Severity
High 7.5
Published
23 Oct 2023
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Fixed in
2.4.58
Sources
NVD

Affected software

SoftwareAffected versions
Apache HTTP ServerServers and applications · cpe:a:apache:http_server
  • From 2.4.55 before 2.4.58

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-43622
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-43622