CVE-2023-45802
Fixed in a distro release EPSS 3%
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.4.58, which fixes the issue.
Products: Apache Software Foundation Apache HTTP Server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux:8 | httpd | 2.4.37-64.module_el8.10.0+3761+75f8c656 |
| AlmaLinux:8 | httpd-devel | 2.4.37-64.module_el8.10.0+3761+75f8c656 |
| AlmaLinux:8 | httpd-filesystem | 2.4.37-64.module_el8.10.0+3761+75f8c656 |
| AlmaLinux:8 | httpd-manual | 2.4.37-64.module_el8.10.0+3761+75f8c656 |
| AlmaLinux:8 | httpd-tools | 2.4.37-64.module_el8.10.0+3761+75f8c656 |
| AlmaLinux:8 | mod_http2 | 1.15.7-10.module_el8.10.0+3832+564e7653 |
| AlmaLinux:8 | mod_ldap | 2.4.37-64.module_el8.10.0+3761+75f8c656 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.6.0+3031+fb177b09 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa |
| AlmaLinux:8 | mod_proxy_html | 1:2.4.37-64.module_el8.10.0+3761+75f8c656 |
| AlmaLinux:8 | mod_session | 2.4.37-64.module_el8.10.0+3761+75f8c656 |
| AlmaLinux:8 | mod_ssl | 1:2.4.37-64.module_el8.10.0+3761+75f8c656 |
| AlmaLinux:9 | mod_http2 | 2.0.26-1.el9 |
| Alpine:v3.15 | apache2 | 2.4.58-r0 |
| Alpine:v3.16 | apache2 | 2.4.58-r0 |
| Alpine:v3.17 | apache2 | 2.4.58-r0 |
| Alpine:v3.18 | apache2 | 2.4.58-r0 |
| Alpine:v3.19 | apache2 | 2.4.58-r0 |
| Alpine:v3.20 | apache2 | 2.4.58-r0 |
| Alpine:v3.21 | apache2 | 2.4.58-r0 |
| Alpine:v3.22 | apache2 | 2.4.58-r0 |
| Alpine:v3.23 | apache2 | 2.4.58-r0 |
| Alpine:v3.24 | apache2 | 2.4.58-r0 |
| Debian:10 | apache2 | 2.4.59-1~deb10u1 |
| Debian:11 | apache2 | 2.4.59-1~deb11u1 |
| Debian:12 | apache2 | 2.4.59-1~deb12u1 |
| Debian:13 | apache2 | 2.4.58-1 |
| Debian:14 | apache2 | 2.4.58-1 |
| Red Hat:enterprise_linux:8 | httpd | 0:2.4.37-64.module+el8.10.0+21332+dfb1b40e |
| Red Hat:enterprise_linux:8 | httpd-debuginfo | 0:2.4.37-64.module+el8.10.0+21332+dfb1b40e |
| Red Hat:enterprise_linux:8 | httpd-debugsource | 0:2.4.37-64.module+el8.10.0+21332+dfb1b40e |
| Red Hat:enterprise_linux:8 | httpd-devel | 0:2.4.37-64.module+el8.10.0+21332+dfb1b40e |
| Red Hat:enterprise_linux:8 | httpd-filesystem | 0:2.4.37-64.module+el8.10.0+21332+dfb1b40e |
| Red Hat:enterprise_linux:8 | httpd-manual | 0:2.4.37-64.module+el8.10.0+21332+dfb1b40e |
| Red Hat:enterprise_linux:8 | httpd-tools | 0:2.4.37-64.module+el8.10.0+21332+dfb1b40e |
| Red Hat:enterprise_linux:8 | httpd-tools-debuginfo | 0:2.4.37-64.module+el8.10.0+21332+dfb1b40e |
| Red Hat:enterprise_linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+21653+eaff63f0 |
| Red Hat:enterprise_linux:8 | mod_http2-debuginfo | 0:1.15.7-10.module+el8.10.0+21653+eaff63f0 |
| Red Hat:enterprise_linux:8 | mod_http2-debugsource | 0:1.15.7-10.module+el8.10.0+21653+eaff63f0 |
| Red Hat:enterprise_linux:8 | mod_ldap | 0:2.4.37-64.module+el8.10.0+21332+dfb1b40e |
| Red Hat:enterprise_linux:8 | mod_ldap-debuginfo | 0:2.4.37-64.module+el8.10.0+21332+dfb1b40e |
| Red Hat:enterprise_linux:8 | mod_md | 1:2.0.8-8.module+el8.9.0+19080+567b90f8 |
| Red Hat:enterprise_linux:8 | mod_md-debuginfo | 1:2.0.8-8.module+el8.9.0+19080+567b90f8 |
| Red Hat:enterprise_linux:8 | mod_md-debugsource | 1:2.0.8-8.module+el8.9.0+19080+567b90f8 |
| Red Hat:enterprise_linux:8 | mod_proxy_html | 1:2.4.37-64.module+el8.10.0+21332+dfb1b40e |
| Red Hat:enterprise_linux:8 | mod_proxy_html-debuginfo | 1:2.4.37-64.module+el8.10.0+21332+dfb1b40e |
| Red Hat:enterprise_linux:8 | mod_session | 0:2.4.37-64.module+el8.10.0+21332+dfb1b40e |
| Red Hat:enterprise_linux:8 | mod_session-debuginfo | 0:2.4.37-64.module+el8.10.0+21332+dfb1b40e |
| Red Hat:enterprise_linux:8 | mod_ssl | 1:2.4.37-64.module+el8.10.0+21332+dfb1b40e |
| Red Hat:enterprise_linux:8 | mod_ssl-debuginfo | 1:2.4.37-64.module+el8.10.0+21332+dfb1b40e |
| Red Hat:enterprise_linux:9 | mod_http2 | 0:2.0.26-1.el9 |
| Red Hat:enterprise_linux:9 | mod_http2-debuginfo | 0:2.0.26-1.el9 |
| Red Hat:enterprise_linux:9 | mod_http2-debugsource | 0:2.0.26-1.el9 |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-curl | 0:8.4.0-2.el7jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-curl | 0:8.4.0-2.el8jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-curl-debuginfo | 0:8.4.0-2.el7jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-curl-debuginfo | 0:8.4.0-2.el8jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-libcurl | 0:8.4.0-2.el8jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-libcurl | 0:8.4.0-2.el7jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-libcurl-debuginfo | 0:8.4.0-2.el8jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-libcurl-devel | 0:8.4.0-2.el8jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-libcurl-devel | 0:8.4.0-2.el7jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-mod_http2 | 0:1.15.19-32.el7jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-mod_http2 | 0:1.15.19-32.el8jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-mod_http2-debuginfo | 0:1.15.19-32.el7jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-mod_http2-debuginfo | 0:1.15.19-32.el8jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-mod_jk | 0:1.2.49-1.redhat_1.el8jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-mod_jk | 0:1.2.49-1.redhat_1.el7jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-mod_jk-ap24 | 0:1.2.49-1.redhat_1.el8jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-mod_jk-ap24 | 0:1.2.49-1.redhat_1.el7jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-mod_jk-ap24-debuginfo | 0:1.2.49-1.redhat_1.el8jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-mod_jk-debuginfo | 0:1.2.49-1.redhat_1.el7jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-openssl | 1:1.1.1k-16.el7jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-openssl | 1:1.1.1k-16.el8jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-openssl-debuginfo | 1:1.1.1k-16.el7jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-openssl-debuginfo | 1:1.1.1k-16.el8jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-openssl-devel | 1:1.1.1k-16.el8jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-openssl-devel | 1:1.1.1k-16.el7jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-openssl-libs | 1:1.1.1k-16.el7jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-openssl-libs | 1:1.1.1k-16.el8jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-openssl-libs-debuginfo | 1:1.1.1k-16.el8jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-openssl-perl | 1:1.1.1k-16.el7jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-openssl-perl | 1:1.1.1k-16.el8jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-openssl-static | 1:1.1.1k-16.el7jbcs |
| Red Hat:jboss_core_services:1 | jbcs-httpd24-openssl-static | 1:1.1.1k-16.el8jbcs |
| Red Hat:rhel_eus:8.8 | httpd | 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 |
| Red Hat:rhel_eus:8.8 | httpd-debuginfo | 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 |
| Red Hat:rhel_eus:8.8 | httpd-debugsource | 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 |
| Red Hat:rhel_eus:8.8 | httpd-devel | 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 |
| Red Hat:rhel_eus:8.8 | httpd-filesystem | 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 |
| Red Hat:rhel_eus:8.8 | httpd-manual | 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 |
| Red Hat:rhel_eus:8.8 | httpd-tools | 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 |
| Red Hat:rhel_eus:8.8 | httpd-tools-debuginfo | 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 |
| Red Hat:rhel_eus:8.8 | mod_http2 | 0:1.15.7-8.module+el8.8.0+21773+20528f83.5 |
| Red Hat:rhel_eus:8.8 | mod_http2-debuginfo | 0:1.15.7-8.module+el8.8.0+21773+20528f83.5 |
| Red Hat:rhel_eus:8.8 | mod_http2-debugsource | 0:1.15.7-8.module+el8.8.0+21773+20528f83.5 |
| Red Hat:rhel_eus:8.8 | mod_ldap | 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 |
| Red Hat:rhel_eus:8.8 | mod_ldap-debuginfo | 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 |
| Red Hat:rhel_eus:8.8 | mod_md | 1:2.0.8-8.module+el8.3.0+6814+67d1e611 |
| Red Hat:rhel_eus:8.8 | mod_md-debuginfo | 1:2.0.8-8.module+el8.3.0+6814+67d1e611 |
| Red Hat:rhel_eus:8.8 | mod_md-debugsource | 1:2.0.8-8.module+el8.3.0+6814+67d1e611 |
| Red Hat:rhel_eus:8.8 | mod_proxy_html | 1:2.4.37-56.module+el8.8.0+19808+379766d6.7 |
| Red Hat:rhel_eus:8.8 | mod_proxy_html-debuginfo | 1:2.4.37-56.module+el8.8.0+19808+379766d6.7 |
| Red Hat:rhel_eus:8.8 | mod_session | 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 |
| Red Hat:rhel_eus:8.8 | mod_session-debuginfo | 0:2.4.37-56.module+el8.8.0+19808+379766d6.7 |
| Red Hat:rhel_eus:8.8 | mod_ssl | 1:2.4.37-56.module+el8.8.0+19808+379766d6.7 |
| Red Hat:rhel_eus:8.8 | mod_ssl-debuginfo | 1:2.4.37-56.module+el8.8.0+19808+379766d6.7 |
| Rocky Linux:8 | httpd | 0:2.4.37-64.module+el8.10.0+1717+030a9fed |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1775+6b057638 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.9.0+1370+89cc8ad5 |
| SUSE:Enterprise Storage 7.1 | apache2 | 2.4.51-150200.3.76.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | apache2 | 2.4.51-150200.3.76.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | apache2 | 2.4.51-150200.3.76.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | apache2 | 2.4.51-150400.6.40.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | apache2 | 2.4.66-150400.6.57.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | apache2 | 2.4.51-150400.6.43.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | apache2 | 2.4.51-150400.6.43.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | apache2 | 2.4.66-150400.6.57.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | apache2 | 2.4.51-150400.6.40.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | apache2 | 2.4.66-150400.6.57.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | apache2 | 2.4.66-150400.6.57.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | apache2 | 2.4.51-150400.6.43.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | apache2 | 2.4.51-150400.6.40.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP5 | apache2 | 2.4.51-150400.6.43.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP5 | apache2 | 2.4.51-150400.6.40.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP5 | apache2 | 2.4.51-150400.6.40.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP5 | apache2 | 2.4.51-150400.6.43.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP6 | apache2 | 2.4.51-150400.6.40.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP6 | apache2 | 2.4.51-150400.6.43.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | apache2 | 2.4.51-35.66.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | apache2-tls13 | 2.4.51-35.66.1 |
| SUSE:Linux Enterprise Server 15 SP2-LTSS | apache2 | 2.4.51-150200.3.76.1 |
| SUSE:Linux Enterprise Server 15 SP3-LTSS | apache2 | 2.4.51-150200.3.76.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | apache2 | 2.4.51-150400.6.40.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | apache2 | 2.4.51-150400.6.43.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | apache2 | 2.4.66-150400.6.57.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | apache2 | 2.4.66-150400.6.57.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | apache2 | 2.4.51-35.66.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | apache2-tls13 | 2.4.51-35.66.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | apache2 | 2.4.51-150200.3.76.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | apache2 | 2.4.51-150200.3.76.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | apache2 | 2.4.51-150400.6.43.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | apache2 | 2.4.66-150400.6.57.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | apache2 | 2.4.51-150400.6.40.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | apache2 | 2.4.66-150400.6.57.1 |
| SUSE:Manager Proxy 4.3 | apache2 | 2.4.51-150400.6.40.1 |
| SUSE:Manager Proxy 4.3 | apache2 | 2.4.51-150400.6.43.1 |
| SUSE:Manager Server 4.3 | apache2 | 2.4.51-150400.6.43.1 |
| SUSE:Manager Server 4.3 | apache2 | 2.4.51-150400.6.40.1 |
| Ubuntu:20.04:LTS | apache2 | 2.4.41-4ubuntu3.15 |
| Ubuntu:22.04:LTS | apache2 | 2.4.52-1ubuntu4.7 |
| Ubuntu:24.04:LTS | apache2 | 2.4.58-1ubuntu1 |
| Ubuntu:Pro:14.04:LTS | apache2 | 2.4.7-1ubuntu4.22+esm12 |
| Ubuntu:Pro:16.04:LTS | apache2 | 2.4.18-2ubuntu3.17+esm17 |
| Ubuntu:Pro:18.04:LTS | apache2 | 2.4.29-1ubuntu4.27+esm7 |
| Ubuntu:Pro:20.04:LTS | apache2 | 2.4.41-4ubuntu3.23+esm3 |
| openSUSE:Leap 15.5 | apache2 | 2.4.51-150400.6.43.1 |
| openSUSE:Leap 15.5 | apache2 | 2.4.51-150400.6.40.1 |
| openSUSE:Tumbleweed | apache2 | 2.4.58-1.1 |