CVE-2023-43622 Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
An attacker can exhaust server resources by opening HTTP/2 connections with a zero initial window size, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-43622?
CVE-2023-43622 is a high-severity denial of service vulnerability in Apache Http Server, published on 23 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout.
This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57.
Users are recommended to upgrade to version 2.4.58, which fixes the issue.
Weakness: CWE-400
Which versions are affected by CVE-2023-43622?
1 open source package ship an affected version, including apache. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | From 2.4.55 | 2.4.58 |
Products include Apache Http Server.
How do I fix CVE-2023-43622?
Upgrade apache to 2.4.58 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-43622 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-43622 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2023-43622, AZL-31610, AZL-43639, AZL-44955, BELL-CVE-2023-43622, BIT-apache-2023-43622 and 3 more.